# Account API Keys with Github Access Control
**URL:** https://forums.suse.com/t/account-api-keys-with-github-access-control/4442
**Category:** Rancher 1.x
**Created:** [October 26, 2016, 5:42pm UTC](https://forums.suse.com/t/account-api-keys-with-github-access-control/4442 "2016-10-26T17:42:50Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@shawnHartsell](https://forums.suse.com/u/shawnHartsell)
#### Post date: [October 26, 2016, 5:42pm UTC](https://forums.suse.com/t/account-api-keys-with-github-access-control/4442/1 "2016-10-26T17:42:50Z")
As part of my company’s CI/CD pipeline, we have built a web service that manages the deployments of Rancher stacks across multiple environments. To achieve this we do the following:
- The service is configured to use an account API key and secret. The service uses this to access the Rancher API
- The service makes an API calls to Rancher to get the environments the account has access to via **/v1/projects**
- The account is explicit given “Member” access to our environments
This pattern works well most of the time. However, we have noticed that there are several situations where the call to the projects endpoint is authenticated, but the payload returned is empty. Based on some preliminary tests, we have seen that if we log back into the Rancher UI with the user account, the API will eventually return the environments we expect.
Below is some information about our Rancher instance:
**Version** : 1.1.1
**Access Control** : GitHub (the account we generated the key for is part of our GitHub organization)
Is this a known issue with using Account API keys with GitHub access control? I haven’t noticed the same situation when running tests against a local Rancher instance using the default access control method. I also didn’t find any issue in the Rancher repository.
Thanks 🙂
---
### Author:  [@shawnHartsell](https://forums.suse.com/u/shawnHartsell)
#### Post date: [October 31, 2016, 6:40pm UTC](https://forums.suse.com/t/account-api-keys-with-github-access-control/4442/2 "2016-10-31T18:40:59Z")
Bump…is anyone else having this issue?
---
### Author:  [@aemneina](https://forums.suse.com/u/aemneina)
#### Post date: [November 3, 2016, 8:36pm UTC](https://forums.suse.com/t/account-api-keys-with-github-access-control/4442/3 "2016-11-03T20:36:48Z")
hey @shawnHartsell we have an engineer checking to see if the api key is tied to the github token… will report back on the findings.
---
### Author:  [@johnrengelman](https://forums.suse.com/u/johnrengelman)
#### Post date: [November 7, 2016, 9:26pm UTC](https://forums.suse.com/t/account-api-keys-with-github-access-control/4442/4 "2016-11-07T21:26:01Z")
We have also seen this exact same behavior.
---
### Author:  [@aemneina](https://forums.suse.com/u/aemneina)
#### Post date: [November 8, 2016, 11:17pm UTC](https://forums.suse.com/t/account-api-keys-with-github-access-control/4442/5 "2016-11-08T23:17:30Z")
Looks like the github token is directly related to the user api key validity. One could extend this by editing https://RANCHER\_URL/v1/activesettings/1as!api.auth.jwt.token.expiry
Let me know if that solves it for you.
---
### Author:  [@vincent](https://forums.suse.com/u/vincent)
#### Post date: [November 8, 2016, 11:43pm UTC](https://forums.suse.com/t/account-api-keys-with-github-access-control/4442/6 "2016-11-08T23:43:50Z")
Uh, no… creating auth tokens with long lifetimes is a bad idea, and is unrelated to the github token, which is good forever. If the github token needs to be refreshed every 16 hours that’s a bug.
---
### Author:  [@shawnHartsell](https://forums.suse.com/u/shawnHartsell)
#### Post date: [November 8, 2016, 11:56pm UTC](https://forums.suse.com/t/account-api-keys-with-github-access-control/4442/7 "2016-11-08T23:56:07Z")
I agree with Vincent, I don’t think it would be a good idea from a security
perspective to do that, even if we can somehow localize it to an individual
account.
---
### Author:  [@aemneina](https://forums.suse.com/u/aemneina)
#### Post date: [November 9, 2016, 12:42am UTC](https://forums.suse.com/t/account-api-keys-with-github-access-control/4442/8 "2016-11-09T00:42:15Z")
I’ll file a bug for this
---
### Author:  [@shawnHartsell](https://forums.suse.com/u/shawnHartsell)
#### Post date: [November 9, 2016, 2:55pm UTC](https://forums.suse.com/t/account-api-keys-with-github-access-control/4442/9 "2016-11-09T14:55:51Z")
Is there a work around for this issue besides what’s already been mentioned? Is there a way to set up a local user account (with GitHub access control still enabled) via the REST API and use those account API keys?