> For the complete documentation index, see [llms.txt](https://docs.api.intratool.de/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.api.intratool.de/api-reference/user-login-tokens.md).

# UserLoginTokens

## Introduction

`UserLoginTokens` are short-lived, one-time credentials that let a browser sign in a [User](/api-reference/users.md) without entering that user's password. See [User Login Token](/introduction/authorization/third-party-login.md#user-login-token) for the browser login flow.

{% hint style="warning" %}
The signed `token` is returned only when the record is created. Store or forward it securely because list and show responses cannot retrieve it later.
{% endhint %}

## Model Definition

**Relations**

| Key         | Relation                        | Type       | Relation Field(s) |
| ----------- | ------------------------------- | ---------- | ----------------- |
| `user`      | [User](/api-reference/users.md) | Belongs to | `user_id`         |
| `loginUser` | [User](/api-reference/users.md) | Belongs to | `login_user_id`   |

Tokens use UUIDs, expire at `expires_at`, and are soft-deleted after use or explicit deletion.

## Admin: List

List all `UserLoginTokens` in administration scope.

**Definition**

<mark style="color:green;">`GET`</mark> `/api/administration/users/login-tokens`

**Request Keys**

| Key         | Type      | Default                           | Description                          |
| ----------- | --------- | --------------------------------- | ------------------------------------ |
| `selects`   | `string`  | All fields except the internal ID | Comma-separated fields to return.    |
| `relations` | `string`  | Default relations                 | Pipe-separated relations to include. |
| `limit`     | `integer` | No limit                          | Maximum number of records.           |

**Behavior**

The administration list includes soft-deleted tokens. The secret `token` is never returned.

**Example Request**

{% tabs %}
{% tab title="PHP" %}

```php
$client = new GuzzleHttp\Client(['base_uri' => 'https://{tenant}.intratool.de']);
$response = $client->request('GET', '/api/administration/users/login-tokens', [
    'headers' => ['Authorization' => "Bearer {accessToken}"]
]);
```

{% endtab %}
{% endtabs %}

**Example Response**

```json
[
  {
    "uuid": "4dcc0220-45b8-4e96-bae1-cb645cc49965",
    "user_id": 7,
    "login_user_id": 8,
    "expires_at": "2026-08-06 11:05:00",
    "created_at": "2026-08-06 11:00:00",
    "updated_at": "2026-08-06 11:00:00",
    "deleted_at": null
  },
  {
    "uuid": "c4d1d6d0-1ea0-4b25-9a26-07951f495c43",
    "user_id": 7,
    "login_user_id": 19,
    "expires_at": "2026-08-06 12:00:00",
    "created_at": "2026-08-06 10:00:00",
    "updated_at": "2026-08-06 10:12:00",
    "deleted_at": "2026-08-06 10:12:00"
  }
]
```

## Admin: Show

Show one `UserLoginToken` in administration scope.

**Definition**

<mark style="color:green;">`GET`</mark> `/api/administration/users/login-tokens/{userLoginToken}`

**Route Parameters**

| Parameter        | Type   | Description          |
| ---------------- | ------ | -------------------- |
| `userLoginToken` | `UUID` | UserLoginToken UUID. |

**Request Keys**

| Key         | Type     | Default                           | Description                          |
| ----------- | -------- | --------------------------------- | ------------------------------------ |
| `selects`   | `string` | All fields except the internal ID | Comma-separated fields to return.    |
| `relations` | `string` | Default relations                 | Pipe-separated relations to include. |

**Example Request**

{% tabs %}
{% tab title="PHP" %}

```php
$client = new GuzzleHttp\Client(['base_uri' => 'https://{tenant}.intratool.de']);
$response = $client->request('GET', '/api/administration/users/login-tokens/4dcc0220-45b8-4e96-bae1-cb645cc49965', [
    'headers' => ['Authorization' => "Bearer {accessToken}"]
]);
```

{% endtab %}
{% endtabs %}

**Example Response**

```json
{
  "uuid": "4dcc0220-45b8-4e96-bae1-cb645cc49965",
  "user_id": 7,
  "login_user_id": 8,
  "expires_at": "2026-08-06 11:05:00",
  "created_at": "2026-08-06 11:00:00",
  "updated_at": "2026-08-06 11:00:00",
  "deleted_at": null
}
```

## Admin: Create by User ID

Create a `UserLoginToken` for one user ID.

**Definition**

<mark style="color:yellow;">`POST`</mark> `/api/administration/users/login-tokens`

**Request Keys**

| Key               | Type      | Default | Description                                                      |
| ----------------- | --------- | ------- | ---------------------------------------------------------------- |
| `login_user_id`\* | `integer` | -       | Active, non-internal [User](/api-reference/users.md) to sign in. |
| `expires_in`\*    | `integer` | -       | Lifetime in seconds, from 1 through 86400.                       |

Keys with `*` are required.

**Behavior**

`user_id` is always taken from the authenticated user and cannot be overridden. The example's 300-second lifetime produces the shown `expires_at` value from the creation time.

**Example Request**

{% tabs %}
{% tab title="PHP" %}

```php
$client = new GuzzleHttp\Client(['base_uri' => 'https://{tenant}.intratool.de']);
$response = $client->request('POST', '/api/administration/users/login-tokens', [
    'headers' => ['Authorization' => "Bearer {accessToken}"],
    'json' => [
        'login_user_id' => 8,
        'expires_in' => 300
    ]
]);
```

{% endtab %}
{% endtabs %}

**Example Response**

```json
{
  "status": "success",
  "data": {
    "uuid": "4dcc0220-45b8-4e96-bae1-cb645cc49965",
    "user_id": 7,
    "login_user_id": 8,
    "expires_at": "2026-08-06 11:05:00",
    "created_at": "2026-08-06 11:00:00",
    "updated_at": "2026-08-06 11:00:00",
    "deleted_at": null,
    "token": "eyJhbGciOiJSUzI1NiJ9.eyJsdGkiOiI0ZGNjMDIyMC00NWI4LTRlOTYtYmFlMS1jYjY0NWNjNDk5NjUiLCJzdWIiOjh9.signature"
  }
}
```

## Admin: Create by Email

Create a `UserLoginToken` for one email address.

**Definition**

<mark style="color:yellow;">`POST`</mark> `/api/administration/users/login-tokens/email`

**Request Keys**

| Key                  | Type      | Default | Description                                                              |
| -------------------- | --------- | ------- | ------------------------------------------------------------------------ |
| `login_user_email`\* | `string`  | -       | Unique email of an active, non-internal [User](/api-reference/users.md). |
| `expires_in`\*       | `integer` | -       | Lifetime in seconds, from 1 through 86400.                               |

Keys with `*` are required.

**Behavior**

`user_id` is always taken from the authenticated user. The email is resolved to `login_user_id`; therefore the example request contains the value needed to produce `login_user_id: 19` in the response.

**Example Request**

{% tabs %}
{% tab title="PHP" %}

```php
$client = new GuzzleHttp\Client(['base_uri' => 'https://{tenant}.intratool.de']);
$response = $client->request('POST', '/api/administration/users/login-tokens/email', [
    'headers' => ['Authorization' => "Bearer {accessToken}"],
    'json' => [
        'login_user_email' => 'morgan.chen@example.com',
        'expires_in' => 900
    ]
]);
```

{% endtab %}
{% endtabs %}

**Example Response**

```json
{
  "status": "success",
  "data": {
    "uuid": "9f9771b3-c6fe-442e-81c8-af4d0bde93bc",
    "user_id": 7,
    "login_user_id": 19,
    "expires_at": "2026-08-06 11:30:00",
    "created_at": "2026-08-06 11:15:00",
    "updated_at": "2026-08-06 11:15:00",
    "deleted_at": null,
    "token": "eyJhbGciOiJSUzI1NiJ9.eyJsdGkiOiI5Zjk3NzFiMy1jNmZlLTQ0MmUtODFjOC1hZjRkMGJkZTkzYmMiLCJzdWIiOjE5fQ.signature"
  }
}
```

## Admin: Delete

Delete an existing `UserLoginToken`.

**Definition**

<mark style="color:red;">`DELETE`</mark> `/api/administration/users/login-tokens/{userLoginToken}`

**Route Parameters**

| Parameter        | Type   | Description          |
| ---------------- | ------ | -------------------- |
| `userLoginToken` | `UUID` | UserLoginToken UUID. |

**Example Request**

{% tabs %}
{% tab title="PHP" %}

```php
$client = new GuzzleHttp\Client(['base_uri' => 'https://{tenant}.intratool.de']);
$response = $client->request('DELETE', '/api/administration/users/login-tokens/4dcc0220-45b8-4e96-bae1-cb645cc49965', [
    'headers' => ['Authorization' => "Bearer {accessToken}"]
]);
```

{% endtab %}
{% endtabs %}

**Example Response**

```json
{
  "status": "success",
  "data": null
}
```