Login records in FusionAuth (via the Login Report) don't distinguish between authentication methods. The response fields include applicationId, applicationName, loginId, loginIdType, instant, ipAddress, and userId, but none indicate the credential type used (token vs. password vs. SSO).
Recommended Approach
You can determine token usage by checking the lastLoginInstant field on user registrations:
Use the
Retrieve User Registration endpoint (GET /api/user/registration/{userId}/{applicationId}) or search for users with tokens
For each registration with an authenticationToken, check the lastLoginInstant against your time windows (30 days, 90 days, 1 year)
If lastLoginInstant falls within your time window for any user, someone authenticated to that application during that period
Here's a Python script approach:
import requests
from datetime import datetime, timedelta
# Define time windows
windows = {
'30d': datetime.now() - timedelta(days=30),
'90d': datetime.now() - timedelta(days=90),
'1y': datetime.now() - timedelta(days=365)
}
# Pull registrations for your application
# Check each registration's lastLoginInstant against cutoffs
# Count how many fall within each window
If all time windows return 0 users: Nobody authenticated to that application during those periods, so the tokens weren't used.
If users show up: The lastLoginInstant can't distinguish whether they used the token, password, or SSO. In this case, you have two additional options:
Check proxy/application logs for /api/login API calls and examine the request body to see if loginId and password were provided, or if it was a token-based authentication
Check webhook events: If you have webhooks configured, examine user.login.success events for the authenticationType field. When a user authenticates with an application authentication token, the value will be APPLICATION_TOKEN. Other possible values include PASSWORD, REFRESH_TOKEN, identity providers like GOOGLE or FACEBOOK, and many more.
Check JWTs: If you capture or log JWTs, the access token contains an authenticationType claim that indicates the authentication method used. For authentication tokens, this will be set to APPLICATION_TOKEN.
Related Documentation
Application Authentication Tokens - Overview of application authentication tokens and how they work
Retrieve a User Registration API - API documentation for retrieving user registration details including authenticationToken and lastLoginInstant
Search Login Records API - API for searching login records (note: does not include authenticationType)
User Login Success Event - Webhook event that includes authenticationType field
Authentication Types Reference - Complete list of authentication types including APPLICATION_TOKEN, PASSWORD, and others
Login API - API for authenticating users with various methods including authentication tokens