RocketChat personal access token

[pierreozoux]

Hi,

thanks a lot to start the dev of this :) this is really nice!

I just installed, and it is a really good starter.

I have one question, why, as an admin, do I have to user a personal access token as each user will connect with their own credentials. Can't the admin also log with their own credentials? ro do you need to do some api calls that require this admin cred?

Also, in term of security, is this token stored in the database? Can a user access it?
I know it is 0.1 alpha version, but still curious :)

Thanks!

[orzuionut]

Hi, indeed we need the admin credentials to make API calls to Rocket Chat.
Yeah, the token is stored in the Nextcloud database, so anyone who has access to that database also has access to that token.
We will look into that in the future to improve it.

[pierreozoux]

It has to be stored somewhere, and there is a need for that.
Is it possible to a scoped token instead of an admin?