Summary

Add flexibility and time-sensitivity when creating client API tokens.

Review Request #15104 — Created June 7, 2026 and updated June 25, 2026, 9:24 a.m.

Information

Owner

chipx86

Repository

Review Board

Branch

release-8.x

Bugs

Depends On

Reviewers

Groups

reviewboard

People

Description

WebAPIToken.objects.get_or_create_client_token() can now be given a
Local Site for filtering or creating tokens, as well as a default
extra_data and a default token policy for new tokens. This gives
callers more control over the resulting token.

It also now takes a min_validity_secs, which specifies the minimum
time an existing token must be valid in order to be considered. This
defaults to 5 minutes, which should be a good minimum default for
anything that may need to perform an immediate operation. Callers can
pass in a longer validity window.

Testing Done

Unit tests pass.

Commits

Summary	ID
Add flexibility and time-sensitivity when creating client API tokens. `WebAPIToken.objects.get_or_create_client_token()` can now be given a Local Site for filtering or creating tokens, as well as a default `extra_data` and a default token policy for new tokens. This gives callers more control over the resulting token. It also now takes a `min_validity_secs`, which specifies the minimum time an existing token must be valid in order to be considered. This defaults to 5 minutes, which should be a good minimum default for anything that may need to perform an immediate operation. Callers can pass in a longer validity window.	f41dbf6a99199c0ff7f488fb862ccef2f9944bb4

Summary

Add flexibility and time-sensitivity when creating client API tokens.

`WebAPIToken.objects.get_or_create_client_token()` can now be given a Local Site for filtering or creating tokens, as well as a default `extra_data` and a default token policy for new tokens. This gives callers more control over the resulting token. It also now takes a `min_validity_secs`, which specifies the minimum time an existing token must be valid in order to be considered. This defaults to 5 minutes, which should be a good minimum default for anything that may need to perform an immediate operation. Callers can pass in a longer validity window.

f41dbf6a99199c0ff7f488fb862ccef2f9944bb4

Issues

Description	From	Last Updated
Typo: an -> and	david	June 24, 2026, 9:20 p.m.
This isn't including ignore_deprecated in the args.	david	June 24, 2026, 9:21 p.m.
This should be + timedelta, not -	david	June 24, 2026, 9:22 p.m.
While it's unlikely that default_extra_data would include a client_name key, I feel like we should switch these just in case.	david	June 25, 2026, 9:24 a.m.

flake8 passed.

JSHint passed.

reviewboard/webapi/managers.py (Diff revision 1)
The issue has been resolved. Show all issues
```
Typo: an -> and
```
reviewboard/webapi/tests/test_managers.py (Diff revision 1)
The issue has been resolved. Show all issues
```
This isn't including ignore_deprecated in the args.
```
reviewboard/webapi/tests/test_managers.py (Diff revision 1)
The issue has been resolved. Show all issues
```
This should be + timedelta, not -
```

Change Summary:


Added the missing ignore_deprecated=True in the test, and fixed the results.
Fixed a time delta.
Fixed a typo.

Commits:

	Summary	ID
	Add flexibility and time-sensitivity when creating client API tokens. `WebAPIToken.objects.get_or_create_client_token()` can now be given a Local Site for filtering or creating tokens, as well as a default `extra_data` and a default token policy for new tokens. This gives callers more control over the resulting token. It also now takes a `min_validity_secs`, which specifies the minimum time an existing token must be valid in order to be considered. This defaults to 5 minutes, which should be a good minimum default for anything that may need to perform an immediate operation. Callers can pass in a longer validity window.	6ac2dfdad291dfcf862c1d953cd20d5d1172a34d
	Add flexibility and time-sensitivity when creating client API tokens. `WebAPIToken.objects.get_or_create_client_token()` can now be given a Local Site for filtering or creating tokens, as well as a default `extra_data` and a default token policy for new tokens. This gives callers more control over the resulting token. It also now takes a `min_validity_secs`, which specifies the minimum time an existing token must be valid in order to be considered. This defaults to 5 minutes, which should be a good minimum default for anything that may need to perform an immediate operation. Callers can pass in a longer validity window.	f41dbf6a99199c0ff7f488fb862ccef2f9944bb4

Diff:

Revision 2 (+566 -44)

Show changes

	reviewboard/webapi/managers.py
	reviewboard/webapi/tests/test_managers.py

Checks run (2 succeeded)

flake8 passed.

JSHint passed.

Ship it!

```
Ship It!
```

Fix it!

reviewboard/webapi/managers.py (Diff revision 2)

An issue was opened. Show all issues

While it's unlikely that default_extra_data would include a client_name key, I feel like we should switch these just in case.