Create access token for selected projects

[Anil_Ranathunga]

In my organisation we need to call asana API for create tasks in different projects. these projects belongs to different teams theres no one person who has access to all projects.

How to create access token to use in our platform’s backend with limited access to the projects we needs to interact from our platform.

[lpb]

Welcome, @Anil_Ranathunga,

This is only possible in the Enterprise plan using Service Accounts:

Service Accounts

See also:

More granular OAuth 2.0/Personal Access Tokens and Asana?

These may be naive questions, but… Is there any way to characterize the risk of granting access? I understand, from the nice Asana API pages, that this is only done by granting a temporary, refreshable-every-hour token, which can only be used alongside the client app’s already-registered token. (I’m probably misusing some terminology here.) With so many integration tools (IFTTT, Zapier, others), I think twice about whether I want to authorize each one. Even if the risk in (1) is low, I, an…

Thanks,

Larry

[Phil_Seeman]

@lpb Are you sure? Service accounts have access to all of an organization’s data; I wasn’t aware it was possible to scope them to just specific projects?

[lpb]

@Phil_Seeman,

I was offering a solution to:

@Anil_Ranathunga

theres no one person who has access to all projects

because the service account would offer that access, but of course access to all org data as well.

Another option would be to add one user to all the projects and then get a personal access token for that user.

Hope that clarifies,

Larry

[Bastien_Siebman]

@lpb

Another option would be to add one user to all the projects and then get a personal access token for that user.

That’s the trick we use for our tool Asana Pulse. Works fine.

[Jeff_Schneider]

How to create access tokens…with limited access to projects

For others that may be curious on how to create tokens with limited access, one approach is to create either an Asana guest or limited access member and then use this Asana account to generate the personal access token (PAT) for your app.

You can then invite the guest/limited access Asana user only to the projects you want the PAT to have access to. This is a useful workaround for creating bots with limited scopes.