We’re an embedded (Powered by Fivetran) customer running Activations through the V2 API. Each of our customers has its own Activation source and group, and we’d like each to have its own credential, so that a credential can only ever reach one customer’s data.

Under V1 that was possible: the Organization API could fetch a workspace’s API key, so onboarding a customer could create a workspace and a scoped key with no human involved. That endpoint is now sunset, and the V2 endpoints authenticate with personal access tokens only, which can be minted and revoked only in the UI, by a signed-in user, and which never expire.

So today the only way to scope a V2 credential per customer is to create a user per customer, sign in as that user and mint a token by hand, and repeat at every rotation. That doesn’t scale for an embedded product, which pushes us to one token per environment with tenant isolation enforced in our own code instead of at Fivetran.

The request: a way to create and revoke a personal access token through the API (Fivetran REST or Activations), ideally with an expiry, for a user or service account whose permissions are managed through the Teams and Groups API. Support has confirmed this isn’t available and has no timeline, and suggested raising it here.