When using Personal Access Tokens to access Asana via API, will the token be limited to the permissions of the user who created the token? For example, if user has Editor access on Project A but only Viewer access on Project B, then the user’s PAT will also have Editor access on Project A but only viewer access on Project B?
Will the PAT be able to see any portfolio/goal/project/task that the user is not already a member of through the Asana front-end?
Hi @Michael_Barry,
(FYI I moved your post to the English Forum > Developers & API forum section.)
Yes, exactly!
The PAT will have the exact same access as its creating user has in the Asana web app.
The only caveat I would add is to be careful when you say “member of”; Asana’s permissions structure can be pretty complex these days so it’s possible for someone to have access to, say, a task even though they are not a member of the project that task lives in.
Hi @Michael_Barry , it’s also a good idea to sacrifice a user/seat/license and dedicate it to such a ‘service account’, for example called ‘Asana’ or ‘Asana bot’ or ‘Asana Admin’ so that all actions appear as this user, instead of ‘Michael did this…’ logged everywhere.
The only thing you need to do is make sure you add that account everywhere it needs to read and take action. That way, you don’t need to worry about providing access to a user that you otherwise wouldn’t.
This method comes in handy when you need 3rd party integrators, but Asana’s Service Account within the Admin Console won’t do.
And since you are on Enterprise, remember you can also build Custom scripts within rules now.
Thanks @Richard_Sather.