See also Temporary Users

New in Tiki5, and improved since Tiki9.

Allows to access the content with superior rights with the presentation of a token. The primary use of this authentication method is to grant temporary access to content to an external service. Ex.: an external service needs to crawl your content to make a report.

It is also possible to combine with Share. This is good if you want to give a one time access to a page or a file, without creating a username/password and setting the group and permissions.

This is especially useful if you want to share a large file without having to send it via e-mail.

Starting in Tiki9, there is an admin panel at: "Admin home > Security > Tokens" (tiki-admin.php?page=security&cookietab#contentadmin1-4):

Moreover, Tiki9 brings an interface to manage tokens at (tiki-admin_tokens.php). For instance, if you have shared permissions to view some page with one friend, you would have one token generated for your page, which can be listed with this interface:

If you want to create new tokens by hand, you can do that with the tab "Add new token".
If the SEFURL feature is not active, in the "Full URL" field you need to copy paste the full URL of the page in the "tiki-" format as shown on the image above.
If the SEFURL feature is active, you need to copy paste the SEFURL style URL like /R202312C testing.

In the "Groups" field you insert the Groups you want to be "applied" on the user or a service accessing the page with the token as if they were a member of that group.

One use case for this manual setting of token access is to manage Batch actions, that can be run based on cron jobs set on external servers. See more information in Batch
Another use case is to give access to page contents to crawlers for indexing your site or feeding an AI. You may consider accessing the simpler print version of pages using URLs such as /tiki-print.php?page=R202312C+testing&TOKEN=….

• You cannot edit already created tokens.
• The token param requested in the URL must always be in uppercase letters: TOKEN=....
• When using a token with group permissions (for example Registered), the user inherits the permissions of that group but is not considered an actual member of the group.   As a result, the `{GROUP}` plugin will not recognize the token user as belonging to the group.  

Seen by Anonymous.
{GROUP(groups="Registered")}
Seen by Registered. {GROUP}

Seen by Anonymous.

To overcome this limitation, we recommend using Temporary Users, since they are treated as actual group members. This ensures that content within {GROUP} blocks is properly displayed.

• The URL used to generate the new token should not contain any URL encoded values, like %2C, and any multivalue array field params with square brackets, like listfields[]. For example using URL like this will fail:

https://yoursite/tiki-ajax_services.php?controller=tracker&action=export_items&trackerId=3&encoding=UTF-8&separator=%2C&delimitorL="&delimitorR="&CR=%25%25%25&listfields[]=2&listfields[]=3&recordsMax=-1

• You will get an error message "Token Error: Your access to this page has expired" when you try to access that page using the token.

https://yoursite/tiki-ajax_services.php?controller=tracker&action=export_items&trackerId=3&encoding=UTF-8&separator=,&CR=%%%&recordsMax=-1

Then accessing the URL using https://yoursite/tiki-ajax_services.php?controller=tracker&action=export_items&trackerId=3&encoding=UTF-8&separator=,&CR=%%%&recordsMax=-1&TOKEN=... will work.

• PluginGetAccessToken
• Batch
• Tokens
• PluginArchiveBuilder

Token | TokenAccess | Tokens | Security Token