# keystone.token.provider module

Token provider interface.

class keystone.token.provider.Manager

  Bases: `Manager`

  Default pivot point for the token provider backend.

  See `keystone.common.manager.Manager` for more details on how this dynamically calls the backend.

  V3 = 'v3.0'
  VERSIONS = frozenset({'v3.0'})
  check_revocation(token)
  check_revocation_v3(token_values)
  driver_namespace: str = 'keystone.token.provider'
  invalidate_individual_token_cache(token)
  issue_token(user_id, method_names, expires_at=None, system=None, project_id=None, domain_id=None, auth_context=None, trust_id=None, app_cred_id=None, thumbprint=None, parent_audit_id=None)
  revoke_token(token_id, revoke_chain=False)
  validate_token(token_id, window_seconds=0, access_rules_support=None)

keystone.token.provider.default_expire_time()

  Determine when a fresh token should expire.

  Expiration time varies based on configuration (see `[token] expiration`).

  Returns:

    a naive UTC datetime.datetime object

keystone.token.provider.random_urlsafe_str()

  Generate a random URL-safe string.

  Return type:

    str

this page last updated: 2026-06-11 21:50:20

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug