[GH-ISSUE #297] add support for api tokens when sending message. #230

New issue

Closed

opened 2026-05-07 00:21:50 +02:00 by BreizhHardware · 2 comments

BreizhHardware commented

2026-05-07 00:21:50 +02:00

Owner

Originally created by @prabirshrestha on GitHub (Jun 1, 2022).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/297

I would like each app to use separate tokens so I can easily track who and which app is sending the messages. I like how PushOver has done it where you create an app with name,description,icon and have a button to generate api token for it.

Should be able to set custom expiration for tokens. Some tokens I may have never expire.

This becomes crucial when LDAP is supported in https://github.com/binwiederhier/ntfy/issues/296. As I don't want to save my username and password in random scripts.

Originally created by @prabirshrestha on GitHub (Jun 1, 2022). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/297 I would like each app to use separate tokens so I can easily track who and which app is sending the messages. I like how PushOver has done it where you create an app with name,description,icon and have a button to generate api token for it. Should be able to set custom expiration for tokens. Some tokens I may have never expire. This becomes crucial when LDAP is supported in https://github.com/binwiederhier/ntfy/issues/296. As I don't want to save my username and password in random scripts.

BreizhHardware

2026-05-07 00:21:50 +02:00

closed this issue
added the
prio:low

server
labels

BreizhHardware commented

2026-05-07 00:21:51 +02:00

Author

Owner

@binwiederhier commented on GitHub (Jun 1, 2022):

The design of the auth feature is very rudimentary, but at the same time very powerful. I encourage you to read up on #19 of the designs we discussed there.

Fundamentally, I do not disagree that expiring tokens could be a good addition, but ... (and this may shock you :-)): A token is just a password without a user and a different name

For some reason, people think passwords are bad, but tokens are good, though they are fundamentally the same thing: a symmetric secret.

I don't want to save my username and password in random scripts.

You can do this already by just creating users and ACLs: https://ntfy.sh/docs/config/#access-control -- The only thing that's not supported is expiration, though you could probably script that server-side (that's very hacky though).

Anyway, since 99% of what you want are already there, I put this low on the list, though it sounds like fun to at least implement the user expiry, so I may do that sooner. I may even give you Bearer tokens implemented as users without a name if I feel like it :-D

@binwiederhier commented on GitHub (Jun 1, 2022): The design of the auth feature is very rudimentary, but at the same time very powerful. I encourage you to read up on #19 of the designs we discussed there. Fundamentally, I do not disagree that expiring tokens could be a good addition, but ... (and this may shock you :-)): *A token is just a password without a user and a different name* For some reason, people think passwords are bad, but tokens are good, though they are fundamentally the same thing: a symmetric secret. > I don't want to save my username and password in random scripts. You can do this already by just creating users and ACLs: https://ntfy.sh/docs/config/#access-control -- The only thing that's not supported is expiration, though you could probably script that server-side (that's very hacky though). Anyway, since 99% of what you want are already there, I put this low on the list, though it sounds like fun to at least implement the user expiry, so I may do that sooner. I may even give you `Bearer` tokens implemented as users without a name if I feel like it :-D

BreizhHardware commented

2026-05-07 00:21:51 +02:00

Author

Owner

@binwiederhier commented on GitHub (Mar 13, 2023):

API tokens are implemented now with ntfy 2.0

@binwiederhier commented on GitHub (Mar 13, 2023): API tokens are implemented now with ntfy 2.0