Token vs Username+Passphrase for REST API to Dedicated API User

[arifsaha]

Hi!

I am wondering whether there are any advantage to use token over username and passphrase/password when accessing REST API to a dedicated API user (whose access to credential is the same as access to the token).

In our practices for automated API calls, we like to provide enough resources for the API call but nothing more, and therefore we ended up creating a dedicated functional user in our instance in Splunk Cloud for each function a program or a group of closely related programs need to do through API calls. Consequently, in almost all the cases there is only a single token needed per functional user. Everyone that need to maintain those programs for that function will have access to both the credential of that functional user and that single token, as those team member need to login as the user to test their queries. Therefore there are no isolation of access between token and user credential.

So in this case, are there any advantage to create and use the token over just using username and passphrase/password?

Thank you!

[VatsalJagani]

@arifsaha - There is a scenario where you have having LDAP setup on Splunk which means you have a Splunk password the same as the AD password so you don't want to expose the AD password anywhere, you would rather share the token.

This is just one example, but the basic idea is you are giving access but not the password. Plus you can time-bound the token.

I hope this helps!!!