# Let Users generate restricted M2M API-Token? **URL:** \ **Category:** Get Help\ **Tags:** m2m, api, user\ **Created:** [August 16, 2021, 9:21am UTC](https://community.auth0.com/t/let-users-generate-restricted-m2m-api-token/67991 "2021-08-16T09:21:06Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![thomasmic](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/thomasmic/32/13837_2.png) [@thomasmic](https://community.auth0.com/u/thomasmic)\ **Post date:** [August 16, 2021, 9:21am UTC](https://community.auth0.com/t/let-users-generate-restricted-m2m-api-token/67991/1 "2021-08-16T09:21:06Z")
Hi! I am looking into IAM. I want to give Users the possibility to generate API-Tokens (technically it will be Client Credentials I assume) which gives them API-Access without ROPC. Ideally the long-therm token can be further restricted by the owner. Is there a way to do this? Some therminology to search for? [How to generate tokens for API users? - Auth0 Community](https://community.auth0.com/t/how-to-generate-tokens-for-api-users/9496/4) is basically the same request, but doesn’t contain meaningful responses (except from [How to generate tokens for API users? - #7 by ruby](https://community.auth0.com/t/how-to-generate-tokens-for-api-users/9496/7) but that seems to be too much of a workaround. I don’t assume that refresh-token are reliably valid for 1+ year). Thanks in advance! Thomas ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [August 16, 2021, 8:17pm UTC](https://community.auth0.com/t/let-users-generate-restricted-m2m-api-token/67991/3 "2021-08-16T20:17:18Z")
Hi @thomasmic, Welcome to the Auth0 Community! We don’t currently support an API key like functionality. If you wanted to give your users access to an API, you would need to issue them a client ID and client secret (you would register one application per user), and they should implement the client credentials flow to obtain access tokens in their applications. ---
**Author:** ![thomasmic](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/thomasmic/32/13837_2.png) [@thomasmic](https://community.auth0.com/u/thomasmic)\ **Post date:** [August 17, 2021, 7:56am UTC](https://community.auth0.com/t/let-users-generate-restricted-m2m-api-token/67991/4 "2021-08-17T07:56:05Z")
Thanks @dan.woda! I don’t quite get how their obtained access\_token are linked to their user and how to automatically invalidate them once the user is disabled/deleted. The best alternative would probably be to self-develop the IAM using passportjs or write a Keycloak-Addon? Or do you have another idea? Best Regards! Thomas ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [August 17, 2021, 7:02pm UTC](https://community.auth0.com/t/let-users-generate-restricted-m2m-api-token/67991/5 "2021-08-17T19:02:31Z")
It’s possible to implement using Auth0, but it is not a feature we have turn-key support for. You would have to build out the UI and functionality yourself, Auth0 would just act as the auth server for issuing tokens and managing the user DB. You would need to create a dashboard, store user information about which users have been issued which client credentials, etc. ---
**Author:** ![thomasmic](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/thomasmic/32/13837_2.png) [@thomasmic](https://community.auth0.com/u/thomasmic)\ **Post date:** [August 19, 2021, 7:33am UTC](https://community.auth0.com/t/let-users-generate-restricted-m2m-api-token/67991/6 "2021-08-19T07:33:56Z")
Thanks for the reply - even though it is not what I hoped for! Best Regards! Thomas ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [September 3, 2021, 7:34am UTC](https://community.auth0.com/t/let-users-generate-restricted-m2m-api-token/67991/7 "2021-09-03T07:34:23Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.