Appcenter: API token per app and per feature
Hello,
Describe the solution you'd like
I'd like to create API tokens with more flexible permissions, more precisely for my use case : giving access to only certains apps, and only APK/IPA upload.
Describe alternatives you've considered
Create one AppCenter account for each client.
Additional context
I work in a company where we have apps for multiple clients who sometimes have access to the whole development stack. One client should not be able to see (and interact with) other client's apps.
Minishlink
All 16 comments
This is a critical need and a major security concern for us and our clients (who include Government organisations).
The API token list indicates that such a mechanism is planned ("App" column contains "All Apps"), but there's no option to enable it at present.
thetanz-geoff
on 2 May 2019
@Minishlink We really like this idea. We can't make any promises at the moment, but will keep this open and watch for customer votes/thumbs on this issue.
iageoghe
on 9 May 2019
@iageoghe Chuffed to hear you're so keen on this.
However, given that it's a significant security hole that may not even be obvious to some of your clients, I don't think you should prioritise this based on "votes/thumbs".
End-user organisations may not even be aware of the issue until a breach hits them. For example, if I have an API Token set up for access to Organisation A, and then Organisation B invites me to their App Center, suddenly both Organisations can tamper with each other's resources.
It is also inconsistent with the granular permissions provided for API tokens for equivalent/peer services in this space.
At the very least, please consider implementation a clear and obvious warning advising of the issue, and that the workaround is to create a single App Center account per Organisation.
thetanz-geoff
on 10 May 2019
@thetanz-geoff I would love to discuss this issue with you directly and get additional feedback, would you mind reaching out to me via email? We were unable to validate the bi-directional access portion of your claim, _鈥漵uddenly both Organisations can tamper with each other鈥檚 resources鈥漘 however it is entirely possible that I missed something.
iageoghe
on 13 May 2019
@iageoghe This is a very serious issue, and is one of the blockers preventing us from migrating off of HockeyApp. If it's not resolved before the HockeyApp shutdown we will have to consider alternative providers.
chrisballinger
on 7 Jun 2019
@chrisballinger We hear you loud and clear. Stay tuned.
iageoghe
on 7 Jun 2019
Hello @iageoghe. Do you have any update regarding this request? We would like to create api tokens so only one token will be assigned to the app directly. It will significantly increase an overall security by limiting what user can do with generated api token. In just over a month HockeyApp will be shut down. It will be good to have this feature onboard as soon as possible to proceed with migration smoothly.
PatrykKaczmarek
on 10 Oct 2019
Hey @iageoghe We need to move from HockeyApp, but this feature is needed for us to migrate successfully. Do we have any update on this feature?
khagesh
on 7 Nov 2019
@khagesh @PatrykKaczmarek @chrisballinger We're discussing how to prioritize this work right now. As soon as I have more to share about when it's expected to land, I'll be back here to share.
And thank you for your patience. We're trying to get it done as soon as we can, given the rest of the work to finish up the HockeyApp migration.
ScottArbeit
on 9 Nov 2019
@ScottArbeit Thank you for the update!
chrisballinger
on 9 Nov 2019
any progress on this issue?
francho
on 27 Jan 2020
@francho We are looking into providing tokens per app this quarter. We should have more details in the coming weeks.
iageoghe
on 27 Jan 2020
@iageoghe Awesome, looking forward to it!
chrisballinger
on 18 Feb 2020
@iageoghe Any estimate on when we can expect this option of tokens per app?
Even if we could at least seperate tokens per organisation it would work for us.
timothybowers
on 26 Mar 2020
App API tokens have just been shipped to production. 馃帀 Updated documentation can be found at https://docs.microsoft.com/en-us/appcenter/api-docs.
Thanks to all of our customers who asked for it... we're all thrilled to deliver it. If you run into any issues using App API tokens, please open a support ticket by clicking the ? in the upper-right corner of any App Center page and selecting "Contact Support".
ScottArbeit
on 8 May 2020
@ScottArbeit Awesome, thank you!
chrisballinger
on 8 May 2020
Related issues
DouglasMarq
路
4Comments
sindresorhus
路
3Comments
KSemenenko
路
3Comments
muhammaddadu
路
3Comments
patrickdoodyIRL
路
3Comments
Most helpful comment
@iageoghe Chuffed to hear you're so keen on this.
However, given that it's a significant security hole that may not even be obvious to some of your clients, I don't think you should prioritise this based on "votes/thumbs".
End-user organisations may not even be aware of the issue until a breach hits them. For example, if I have an API Token set up for access to Organisation A, and then Organisation B invites me to their App Center, suddenly both Organisations can tamper with each other's resources.
It is also inconsistent with the granular permissions provided for API tokens for equivalent/peer services in this space.
At the very least, please consider implementation a clear and obvious warning advising of the issue, and that the workaround is to create a single App Center account per Organisation.