Hi There,
Environment
- Automation Engine 24.4, REST API v1
- Personal User Tokens (
Authorization: Bearer <GUID>)
- Two clients on the same system (e.g. 1000 and 2000)
Summary
For a single user, a token created in client 2000 returns HTTP 401 (code 45254) if its name shares the same leading text as a token I already have in client 1000. Only one of the two validates - the other fails. IMO, Tokens are supposed to be per-client, so identical names in different clients shouldn't interfere.
Steps to reproduce
- User X creates
MYTOKEN1 in client 1000 → works (200).
- Same user creates
MYTOKEN2 in client 2000.
- curl -k -H "Authorization: Bearer <TOKEN>" https://<host>/ae/api/v1/2000/system/health → 401, code 45254.
Observed: ALPHA1/ALPHA2 and ALPHA/ALPHA collide; names that differ at the start (e.g. 1000ALPHA/2000ALPHA) both work.
Is this expected?
Workaround: make token names differ up front (eg. lead with the client number).
------------------------------
Regards,
Arun Verma
------------------------------