Description

Adds a new API endpoint POST /api/users/{id}/api-token that creates a new AccessToken for the given user and returns the plain token in the response. This is the missing counterpart of the existing DELETE /api/users/api-token/{id}.

Currently the only way to obtain an AccessToken is via the web UI. This blocks any automated provisioning flow that needs to create a Kimai user and immediately get a usable Bearer token for that user — for example, a SaaS integration that creates one Kimai user per customer. The legacy plainApiToken field on POST /api/users only populates the deprecated users.api_token column used by the X-AUTH-USER/X-AUTH-TOKEN headers, which is not interchangeable with Authorization: Bearer ….

To guarantee that tokens generated via the API and via the web UI always follow the same algorithm, the random-token generation has been extracted into a new factory method AccessToken::createForUser(User $user): self. Both ProfileController::createAccessToken and the new UserController::postApiToken now use this single source of truth. The AccessToken constructor signature (User $user, string $token) is left unchanged so that fixtures and ResetTestCommand, which need predictable tokens, keep working as-is.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• I verified that my code applies to the guidelines (composer code-check)
• I updated the documentation (OpenAPI annotations are included in the controller; happy to open a follow-up PR on www.kimai.org if maintainers want a manual mention)
• I agree that this code is used in Kimai (see license)