# Ensure user auth token age is 90 days or less

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698514288857-ensure-user-auth-token-age-is-90-days-or-less
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every auth token belonging to an IAM user was created within the last 90 days. Auth tokens are used by third-party APIs and tools, such as Docker registry access and Swift clients, that do not support OCI signature-based authentication, so they should be replaced regularly.

**Rationale**

Auth tokens act like passwords and remain valid until they are deleted. Tokens that are never replaced may be stored in scripts, CI pipelines, or laptops, and can be used by anyone who finds them. Replacing tokens at least every 90 days limits how long a leaked token remains useful to an attacker.

**Impact**

-   Limits how long a leaked token can be used
    
-   Removes old tokens that may be stored insecurely
    
-   Tools using an old token must be updated
    

**Default Value**

By default, auth tokens do not expire, and each user can have up to two auth tokens.

**Pre-Requisites**

-   Identity domain administrator or user administrator role
    
-   A list of tools that use each token
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  Open the Tokens and keys tab and find the Auth tokens section (on older consoles, select Auth tokens under Resources).
    
5.  Check the creation date of each token.
    
6.  If any token is older than 90 days, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  Open the Tokens and keys tab, and in the Auth tokens section select Generate token.
    
5.  Enter a description, select Generate token, and copy the token immediately, as it is shown only once.
    
6.  Update every tool that uses the old token.
    
7.  Delete the old token.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  If a tool fails, generate a new token and update the tool with it.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcredentials.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcredentials.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.