---
title: Adding Accounts in Application Token
slug: kronpam-reference-guide-3-9-0/adding-accounts-in-application-token
description: Learn how to create an AAPM account in the Kron PAM Web GUI with this comprehensive document. Find step-by-step instructions for entering application details, linking SAPM accounts, setting restrictions, and incorporating optional parameters based on your
docTags:
createdAt: 2022-07-31T14:08:46.000Z
---
To use an Application Token Rest API, a profile needs to be created for Application Token clients in the Password Vault. These profiles are called Application Token Accounts in the Kron PAM Web GUI.
To create an Application Token account, follow the steps below:
1. Navigate to **Secrets > Vault.**
2. Open the **Application Tokens** tab.
3. Click the **+Add.**
::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/i8ho_C57ZvNO6fimBJrNQ_image.png" size="78" width="958" height="870" position="center" caption="Adding Accounts in Application Token" darkWidth="958" darkHeight="870" showCaption="true"}
4. Enter the **Application Name**, **Event User**, and **Security Level**. You can remove the **Event User** if the account should not be linked to any user on Kron PAM.
5. To enter the requester source **Application Network Address Range**, click the **Plus (add)** button next to the **Application Network Address Range**. In the pop-up screen, enter single or multiple **Network Address Ranges **or** Hostname**.
:::hint{type="info"}
When an application request is received, the client IP is checked against the configured IP address range first. If no match is found, the configured hostname is resolved by using the hosts file first and DNS next; the resolved IP is then compared with the client IP.
:::
6. To link Password Vault account(s), click the **Edit** button next to the **Vault Account** field. You can link a single account or multiple accounts to the Application Token. Linked accounts can be accessed through the same token. Accounts can be searched by name and Group Full Paths.
::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/_YJljyqoafjfA-QKbQiG7_image.png" size="90" width="701" height="665" position="center" caption="Application Token – Add Password Vault Account Pop-up Screen" darkWidth="701" darkHeight="665" showCaption="true"}
7. To link the Password Vault group path(s) to the Application Token account, click the **Edit** button next to the** Account Group** field. You can link a single account group or multiple account groups to the Application Token. Linked groups can be accessed with the same token.
8. If any restrictions are necessary to limit the usage of the token to access account information, activate the relevant ones from the restriction checkboxes. You can set time and usage limits.
9. Activate the **Allow Listing Accounts **checkbox if listing all linked accounts and groups to the **Application Token** is required. If you don't select this checkbox, the linked accounts list cannot be retrieved through the /listSAPMAccounts API.
:::Paragraph{indent="1"}
Enter any optional parameters listed according to your Security Level choice (details described below) and click **Save.**
:::
10. After this step, an Application Token Account is created, and the Application Token authentication token is shown in the pop-up window.
11. Copy this token by clicking the text box (Later, you’ll need to include this parameter in the Rest API requests)
::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/0Mrwj4scnAVXsa8gJtr3-_image.png" size="96" width="980" height="514" position="center" caption="Application Token AAPM Account creation info box" darkWidth="980" darkHeight="514" showCaption="true"}
| **Parameter Name** | **Parameter Value** |
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **App Hash** | The MD5SUM value of the application’s executable file.
(Used for Basic + Pin + Path + Hash Security Level) |
| **App Path** | The path of the application using AAPM
(Used for all Security Levels including Path)**
** |
| **Application IP** | IP Address of the requester application. |
| **Application Name** | Name of the application requesting the AAPM passwords. |
| **Event User** | The user uses the password. (This value is logged in the Password Vault logs as the user of the password.) If the account should be independent of any user, the event user can be removed. If an event user is set and the user permissions are not sufficient to reach the secret, the secret will not be retrieved through AAPM. |
| **OS Account** | The name of the account used by Kron PAM while connecting and checking the path
(Used for all Security Levels including Path)**
** |
| **OS Account Password** | The password of the account that will be used by Kron PAM while connecting and checking the path.
(Used for all Security Levels, including Path, and applicable for Manual User OS Credential Type only)**
** |
| **OS Credential Type** | The credential type used by Kron PAM while connecting and checking the path
Possible values: Vault / Manual User
(Used for all Security Levels including Path)**
** |
| **OS Type** | The operating system type of the server that hosts the application
Possible values: Windows / Linux / Mac OS
(Used for all Security Levels, including Path)**
** |
| **PIN Sending Port** | The port the client application is listening to
Kron PAM sends the PIN to this port (Used for all Security Levels, except Basic)**
** |
| **SAPM Account** | The Password Vault account is used in AAPM.
**
** |
| **Security Level** | The Security Level for the AAPM process. The possible values are:
**Basic**: Default, basic AAPM Flow. The application requests the password via API. Kron PAM checks the application’s token and source IP and sends back the password as the response if everything is correct
**Basic + Pin**: The application requests the password via API. Kron PAM checks the application’s token and source IP and, if everything is connected, sends the PIN to a specific port. The application sends a second request with the PIN code and gets it.
**Basic + Pin + Path**: The application requests the password via API. Kron PAM checks the application’s token and source IP and, if everything is connected, sends the PIN to a specific port. The application sends a second request with the PIN code. Kron PAM checks the path and name of the application and sends back the password if it is true.
**Basic + Pin + Path + Hash**: The application requests the password via API. Kron PAM checks the application’s token and source IP and, if everything is correct, sends the PIN to a specific port. The application sends a second request with the PIN code. Kron PAM checks the path, name, and MD5SUM of the application and sends back the password if it is true**.** |
| **Time Limit** | The Time Limit checkbox enables the users to set an expiry date for the AAPM token. |
| **Expiry Date** | The Expiry Date field allows users to set a deadline for token usage. |
| **Usage Limit** | The Usage Limit checkbox enables the users to set a limit for maximum usage. |
| **Maximum Usage Count** | The Maximum Usage Count allows the users to define a maximum usage limit. |
| **Allow Listing Accounts** | The Allow Listing Accounts checkbox enables the linked Password Vault accounts and groups to be listed through the /listSAPMAccounts API. |