Skip to content

feat: token format redesign #102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eternal-flame-AD merged 4 commits into from
Jul 4, 2026
Merged

feat: token format redesign #102

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7381098
feat: token format redesign
eternal-flame-AD Jun 30, 2026
57de277
apply suggestions
eternal-flame-AD Jul 1, 2026
3bf59dd
apply suggestions
eternal-flame-AD Jul 4, 2026
1dea350
fix: update summary and headline
jmattheis Jul 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions docs/migrate-to-3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@
with [`migrate-config`](#migrating-your-config).
- If you set list or map environment variables, their syntax changed, see
[List and map syntax](#list-and-map-syntax).
- If you rely on the format of tokens or the internal implementation details of token storage, your workflow may need adjusting.
See [token format redesign](#token-format-redesign).

@jmattheis jmattheis Jul 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll change this to better reflect the content of the newly added section. I'll also update the headline.

- If you have scripts hitting client-token endpoints, they may now need
[elevation](#adapting-your-scripts).

Expand Down Expand Up @@ -78,21 +80,36 @@ GOTIFY_SERVER_RESPONSEHEADERS={"X-Custom-Header":"custom value"}

## API Changes

### Token Format Redesign
Comment thread
jmattheis marked this conversation as resolved.
Outdated

Introduces an EdDSA based token validation scheme to prevent storing plaintext token in database
and create potential for fulfilling more feature requests related to security and authentication.
See [#325](https://github.com/gotify/server/issues/325).

Tokens for existing applications can now be rotated via the _application security update_ endpoint.

Existing tokens (starting with `A` and `C`) will continue to work.
Plugin tokens (starting with `P`) used to access web resources are not affected by this change.

Custom tokens created by manually modifying database entry may cease to work upon upgrading,
in such case please rotate tokens or recreate the corresponding client/application entry.

### Step-up Authentication

Introduces step-up authentication via time-limited [session
elevation](./session-elevation.md). A session/client token must re-authenticate
before sensitive, hard-to-undo actions.

HTTP Basic auth and application tokens are unaffected.

### Endpoints that now require elevation

With a non-elevated client token these return `403`:

| Endpoint | Action |
| :-------------------------------------------- | :----------------------------- |
| `POST /current/user/password` | Change current user's password |
| `DELETE /client/{id}` | Delete a client |
| `DELETE /application/{id}` | Delete an application |
| `PUT /application/{id}/security` | Application security update |
| `POST /client/{id}/elevate` | Elevate a client token |
| `GET /user`, `GET`/`POST`/`DELETE /user/{id}` | Manage users (admin) |

Expand Down