How to audit if application authentication tokens have been used for login?

[FASupportBot]

We have authentication tokens enabled for some applications in FusionAuth, and we want to determine if these tokens have actually been used for authentication in the last 30/90/365 days before disabling the feature.

We have approximately 225 users with authentication tokens assigned to their registrations. We can identify which users have tokens using an Elasticsearch query:

{
  "bool": {
    "must": [
      {
        "nested": {
          "path": "registrations",
          "query": {
            "exists": {
              "field": "registrations.authenticationToken"
            }
          }
        }
      }
    ]
  }
}

However, we need to confirm whether these tokens have been actively used for authentication. Is there a way to audit authentication token usage through login records or other mechanisms in FusionAuth?

[FASupportBot]

Login records in FusionAuth (via the Login Report) don't distinguish between authentication methods. The response fields include applicationId, applicationName, loginId, loginIdType, instant, ipAddress, and userId, but none indicate the credential type used (token vs. password vs. SSO).

Recommended Approach

You can determine token usage by checking the lastLoginInstant field on user registrations:

1. Use the Retrieve User Registration endpoint (GET /api/user/registration/{userId}/{applicationId}) or search for users with tokens
2. For each registration with an authenticationToken, check the lastLoginInstant against your time windows (30 days, 90 days, 1 year)
3. If lastLoginInstant falls within your time window for any user, someone authenticated to that application during that period

Here's a Python script approach:

import requests
from datetime import datetime, timedelta

# Define time windows
windows = {
    '30d': datetime.now() - timedelta(days=30),
    '90d': datetime.now() - timedelta(days=90),
    '1y': datetime.now() - timedelta(days=365)
}

# Pull registrations for your application
# Check each registration's lastLoginInstant against cutoffs
# Count how many fall within each window

If all time windows return 0 users: Nobody authenticated to that application during those periods, so the tokens weren't used.

If users show up: The lastLoginInstant can't distinguish whether they used the token, password, or SSO. In this case, you have two additional options:

1. Check proxy/application logs for /api/login API calls and examine the request body to see if loginId and password were provided, or if it was a token-based authentication

2. Check webhook events: If you have webhooks configured, examine user.login.success events for the authenticationType field. When a user authenticates with an application authentication token, the value will be APPLICATION_TOKEN. Other possible values include PASSWORD, REFRESH_TOKEN, identity providers like GOOGLE or FACEBOOK, and many more.

3. Check JWTs: If you capture or log JWTs, the access token contains an authenticationType claim that indicates the authentication method used. For authentication tokens, this will be set to APPLICATION_TOKEN.

Related Documentation

• Application Authentication Tokens - Overview of application authentication tokens and how they work
• Retrieve a User Registration API - API documentation for retrieving user registration details including authenticationToken and lastLoginInstant
• Search Login Records API - API for searching login records (note: does not include authenticationType)
• User Login Success Event - Webhook event that includes authenticationType field
• Authentication Types Reference - Complete list of authentication types including APPLICATION_TOKEN, PASSWORD, and others
• Login API - API for authenticating users with various methods including authentication tokens