No V2 login Client Token

LiteLotus · 2025-12-10T13:56:42.118Z

Hi! My cluster died due to a power failure and the etcd db corrupted. I managed to restore the zitadel db from a backup, however I can't log in due to the "login-client" secret being missing. I have no way of recovering that old secret, is there any way to recover the installation?

A

Ask Inkeep•12/10/25, 1:56 PM

Hi @LiteLotus, I'm an AI assistant for ZITADEL. While a team member reviews this question, I'll see if I can find relevant sources for your question.

A

Ask Inkeep•12/10/25, 1:57 PM

Answer

---

You can manually create a new Personal Access Token (PAT) for the login client to restore access. Here's how: (1)

Create a new machine user (e.g., at `http://localhost:8080/ui/console/users/create-machine%60)
Create a PAT for that user
Save the PAT to a file, for example
```
/path/on/your/host/login-client.pat
```
/path/on/your/host/login-client.pat
```
/path/on/your/host/login-client.pat
```
/path/on/your/host/login-client.pat
Assign the
```
Iam Login Client
```
Iam Login Client
```
Iam Login Client
```
Iam Login Client
role (internally
```
IAM_LOGIN_CLIENT
```
IAM_LOGIN_CLIENT
```
IAM_LOGIN_CLIENT
```
IAM_LOGIN_CLIENT
) to the user
Configure your Login UI with the new token via the
```
ZITADEL_SERVICE_USER_TOKEN
```
ZITADEL_SERVICE_USER_TOKEN
```
ZITADEL_SERVICE_USER_TOKEN
```
ZITADEL_SERVICE_USER_TOKEN
environment variable, or mount the file and use
```
ZITADEL_SERVICE_USER_TOKEN_FILE
```
ZITADEL_SERVICE_USER_TOKEN_FILE
```
ZITADEL_SERVICE_USER_TOKEN_FILE
```
ZITADEL_SERVICE_USER_TOKEN_FILE

Example Docker command:

docker run -p 3000:3000 -v /path/on/your/host/login-client.pat:/path/in/container/login-client.pat:ro -e ZITADEL_SERVICE_USER_TOKEN_FILE=/path/in/container/login-client.pat ghcr.io/zitadel/zitadel-login:latest

docker run -p 3000:3000 -v /path/on/your/host/login-client.pat:/path/in/container/login-client.pat:ro -e ZITADEL_SERVICE_USER_TOKEN_FILE=/path/in/container/login-client.pat ghcr.io/zitadel/zitadel-login:latest

docker run -p 3000:3000 -v /path/on/your/host/login-client.pat:/path/in/container/login-client.pat:ro -e ZITADEL_SERVICE_USER_TOKEN_FILE=/path/in/container/login-client.pat ghcr.io/zitadel/zitadel-login:latest

docker run -p 3000:3000 -v /path/on/your/host/login-client.pat:/path/in/container/login-client.pat:ro -e ZITADEL_SERVICE_USER_TOKEN_FILE=/path/in/container/login-client.pat ghcr.io/zitadel/zitadel-login:latest

Note: If you're unable to access the Console at all to create the machine user, you may need an existing IAM Owner user with a working PAT to make API calls. If you don't have that, you might need to check if the database restore included any existing service users you could leverage.

A

Ask Inkeep•12/10/25, 1:57 PM

To learn more, see the sources I considered:

[1] Connect your Self-Hosted Login UI to Zitadel | ZITADEL Docs

A

Ask Inkeep•12/10/25, 1:57 PM

Feel free to tag @Ask Inkeep with additional questions.

L

LiteLotusOP•12/10/25, 1:58 PM

That solution requires having access to the console in the first place, which I don't have, god damn ai, useless as always.

AAsk Inkeep To learn more, see the sources I considered: [[1] Connect your Self-Hosted Lo...

A

Ask InkeepAPP•12/10/25, 1:58 PM

Got it. Tagging @Rajat for additional help.

R

Rajat•12/10/25, 2:20 PM

hey @LiteLotus I am so sorry for this, but I will check with the team. Usually there's no way to recover if you have lost the pat on the first place but let me check

L

LiteLotusOP•12/10/25, 2:38 PM

I do have access to the dB, and there are still 2 active PATs

L

LiteLotusOP•12/10/25, 2:39 PM

It's just figuring out how those pats map in the db

R

Rajat•12/10/25, 3:12 PM

hey @LiteLotus I will check on this internally and will get back to you, thanks

RRajat hey <@110506908057600000> I will check on this internally and will get back to y...

L

LiteLotusOP•12/10/25, 4:07 PM

Any news?

R

Rajat•12/10/25, 5:22 PM

hey @LiteLotus no, I will let you know when I will have an update. Thanks

L

LiteLotusOP•12/11/25, 11:51 AM

I hate to push, but i need to know wheather i need to restart or if i can get this working because its responsible for the forward authentication and a bunch of other auth for services im trying to get working, this is my blocker

R

Rajat•12/11/25, 1:48 PM

hey @LiteLotus, apologies for delay I got a response from my tream, they will look into this tomorrow is what they told me.

L

LiteLotusOP•12/11/25, 1:49 PM

i hope they do, because if i have to start over this weekend, im not gonna be happy

L

LiteLotusOP•12/11/25, 1:49 PM

at least if i find out tmrw i can get ahead of things a little

LLiteLotus i hope they do, because if i have to start over this weekend, im not gonna be ha...

R

Rajat•12/11/25, 2:02 PM

thank you, you should have a response tomorrow.

L

LiteLotusOP•12/12/25, 5:17 PM

luckilly this is no longer required

L

LiteLotusOP•12/12/25, 5:17 PM

someone from the company has already helped me get it working again

R

Rajat•12/14/25, 8:24 AM

thank you @LiteLotus may I know what did you do to fix it?. If someone else is looking for something similar , they can find it. The question is still raised internally and I was still waiting for a response.
How did you recover the password?.

RRajat thank you <@110506908057600000> may I know what did you do to fix it?. If someon...

L

LiteLotusOP•12/14/25, 3:56 PM

Here is the solution.

problem: V2 login requires token, token is missing/unavailable.
prerequisites: Zitadel serverr running and functioning, access to configs.
steps:

First create a system user following this guide: https://zitadel.com/docs/guides/integrate/zitadel-apis/access-zitadel-system-api#generate-an-rsa-keypair
Once created, find the login api user, using api and curl.
```
curl --request POST --url https://zitadel.url/v2/users --header="Authorization: Bearer $(zitadel-tools key2jwt --audience=https://zitadel.url --key=./system-user-1.pem --issuer=superuser)" | jq
```
curl --request POST --url https://zitadel.url/v2/users --header="Authorization: Bearer $(zitadel-tools key2jwt --audience=https://zitadel.url --key=./system-user-1.pem --issuer=superuser)" | jq
```
curl --request POST --url https://zitadel.url/v2/users --header="Authorization: Bearer $(zitadel-tools key2jwt --audience=https://zitadel.url --key=./system-user-1.pem --issuer=superuser)" | jq
```
curl --request POST --url https://zitadel.url/v2/users --header="Authorization: Bearer $(zitadel-tools key2jwt --audience=https://zitadel.url --key=./system-user-1.pem --issuer=superuser)" | jq
specifically username
```
login-client
```
login-client
```
login-client
```
login-client
once found, create a new PAT for that user. `curl --request POST --url https://zitadel.url/v2/users/user_id_here/pats --header="Authorization: Bearer $(zitadel-tools key2jwt --audience=https://zitadel.url --key=./system-user-1.pem --issuer=superuser)" -d '{"expirationDate": "2519-04-01T08:45:00.000000Z"}' | jq`
Use that created PAT and create a new Secret in Kubernetes named `login-client` with the key `pat`.
deploy in place, and kill the existing pod (assuming its crashloop backoff is too long for your liking)
et voila, working zitadel@Rajat Singh

ZITADEL Docs

This guide focuses on the ZITADEL System API. To access the other APIs (Admin, Auth, Management), please checkout this guide.

R

Rajat•12/15/25, 4:30 AM

Oh wow using api endpoint with key2jwt is veryyyyy veryyy neat!!.
Ive never seen iit being used like this.
Very very neat approach.
Glad that I learned something new (different) today and all thanks to you :))