Least‑Privilege API Tokens vs. SSO Group Mapping: Which Better Handles Token Expiration in QTest?

Answer

Using short‑lived API tokens with an explicit expiration date provides more reliable and immediate revocation than relying on SSO group mapping alone.

Confirmed facts (based on available information)

• QTest API tokens are immutable after creation; they remain valid until their explicit expiration date or until manually deleted.
• Disabling or deleting a QTest user account does not automatically revoke that user’s API tokens.
• SSO session timeouts configured in the identity provider affect only interactive UI/web sessions; they do not influence the validity of API tokens.

Likely explanation

Because token validity is independent of SSO sessions, the only way to guarantee that a token becomes unusable when a user’s access is removed is to bound the token’s lifetime at creation (or to delete it programmatically). SSO group mapping can enforce least‑privilege roles for UI access, but it cannot enforce expiration for API‑driven automation.

Steps to enforce timely revocation in QTest

1. When creating an API token for automation, always set a short expiration (e.g., 24 h or 72 h) that aligns with the expected pipeline runtime.
2. Implement a periodic cleanup job that:
1. Calls the QTest API to list tokens (with pagination) for a given project or user.
2. Filters tokens belonging to disabled or deleted accounts.
3. Issues DELETE requests to revoke those tokens.
3. Verify the process:
1. Before disabling a test user, record a token value and confirm a successful API call.
2. Disable the user account, wait for the cleanup job to run, then retry the call with the same token – it should return 401/403.
3. Check the IdP session timeout setting and confirm that UI sessions expire as expected while API token calls remain functional only until the token’s own expiry.

Missing diagnostic detail that could change the recommendation

Does QTest provide a dedicated API endpoint to bulk‑revoke or delete all tokens associated with a specific user (or to list tokens by user without pagination limits)? If such an endpoint exists, the cleanup job can be simpler and more reliable; if not, administrators must rely on pagination‑aware listing and individual DELETE calls, which increases operational complexity.

Diagram

• Token Creation → Set Expiration
• Periodic Cleanup → List & Delete Tokens for Disabled Users
• SSO Session → IdP Timeout (UI only)