# How to lock down an API token to only access what our application needs

**URL:** <https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305>\
**Category:** Questions\
**Created:** [May 19, 2021, 3:29pm UTC](https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305 "2021-05-19T15:29:21Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![AlexandreUnca](https://avatars.discourse-cdn.com/v4/letter/a/a9adbd/32.png) [@AlexandreUnca](https://devforum.okta.com/u/AlexandreUnca)\
**Post date:** [July 9, 2023, 8:35am UTC](https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305/13 "2023-07-09T08:35:35Z")

</div>

when i an doing authorization mode with “private key” it’s working but i contact the service without passing the credential of my user and so the right that he have (ou don’t have)

I am also trying with bearer token that i generated myselft. The Service App has the right bebause with private key mode i get some result with the function “ListUsers”.

But i think i am missing somehting whe i create the TOKEN jtw with private key

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/5/5e4bc018ec1f517b588c011632144d6e25fae19f.png)

this is how i generate my token :

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/e/e622fcad289bb9b07afb5a7fa01d7d2e02f84438.png)

when i do this  
 ![image](https://global.discourse-cdn.com/oktadev/original/2X/2/23537f838b7259506aa3f6887fde361ac446dfef.png)  
ListUsers is empty.

I don’t this i pass my current user ( witch is me and is super admin) in my token but i don’t know how

---

_[View the full topic](https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305)._