How to audit if application authentication tokens have been used for login?

FASupportBot

We have authentication tokens enabled for some applications in FusionAuth, and we want to determine if these tokens have actually been used for authentication in the last 30/90/365 days before disabling the feature.

We have approximately 225 users with authentication tokens assigned to their registrations. We can identify which users have tokens using an Elasticsearch query:

{
  "bool": {
    "must": [
      {
        "nested": {
          "path": "registrations",
          "query": {
            "exists": {
              "field": "registrations.authenticationToken"
            }
          }
        }
      }
    ]
  }
}

However, we need to confirm whether these tokens have been actively used for authentication. Is there a way to audit authentication token usage through login records or other mechanisms in FusionAuth?

FASupportBot

Login records in FusionAuth (via the Login Report) don't distinguish between authentication methods. The response fields include applicationId, applicationName, loginId, loginIdType, instant, ipAddress, and userId, but none indicate the credential type used (token vs. password vs. SSO).

Recommended Approach

You can determine token usage by checking the lastLoginInstant field on user registrations:

Use the Retrieve User Registration endpoint (GET /api/user/registration/{userId}/{applicationId}) or search for users with tokens
For each registration with an authenticationToken, check the lastLoginInstant against your time windows (30 days, 90 days, 1 year)
If lastLoginInstant falls within your time window for any user, someone authenticated to that application during that period

Here's a Python script approach:

import requests
from datetime import datetime, timedelta

# Define time windows
windows = {
    '30d': datetime.now() - timedelta(days=30),
    '90d': datetime.now() - timedelta(days=90),
    '1y': datetime.now() - timedelta(days=365)
}

# Pull registrations for your application
# Check each registration's lastLoginInstant against cutoffs
# Count how many fall within each window

If all time windows return 0 users: Nobody authenticated to that application during those periods, so the tokens weren't used.

If users show up: The lastLoginInstant can't distinguish whether they used the token, password, or SSO. In this case, you have two additional options:

Check proxy/application logs for /api/login API calls and examine the request body to see if loginId and password were provided, or if it was a token-based authentication
Check webhook events: If you have webhooks configured, examine user.login.success events for the authenticationType field. When a user authenticates with an application authentication token, the value will be APPLICATION_TOKEN. Other possible values include PASSWORD, REFRESH_TOKEN, identity providers like GOOGLE or FACEBOOK, and many more.
Check JWTs: If you capture or log JWTs, the access token contains an authenticationType claim that indicates the authentication method used. For authentication tokens, this will be set to APPLICATION_TOKEN.

How to audit if application authentication tokens have been used for login?

Recommended Approach

Related Documentation