# Occ user:auth-tokens:add (custom password doesn't work)

**URL:** <https://help.nextcloud.com/t/occ-useradd-custom-password-doesnt-work/219348>\
**Category:** ℹ️ Support\
**Tags:** occ\
**Created:** [March 7, 2025, 4:01pm UTC](https://help.nextcloud.com/t/occ-useradd-custom-password-doesnt-work/219348 "2025-03-07T16:01:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zx81](https://help.nextcloud.com/letter_avatar/zx81/32/5_5575768a8748004e209b776fc1b2916d.png) [@zx81](https://help.nextcloud.com/u/zx81)\
**Post date:** [March 7, 2025, 4:01pm UTC](https://help.nextcloud.com/t/occ-useradd-custom-password-doesnt-work/219348/1 "2025-03-07T16:01:52Z")

</div>

Hi

I’m trying to create an auth-token for a user with a custom password. Taking a look to the documentation it can be done with:

```auto
export NC_PASS=mypassword
su -s /bin/sh www-data -c 'php occ user:auth-tokens:add MyUser --password-from-env'

```

And the answer is:

```auto
app password:
H93Ddv3Zy0x90ssDcmMsBIoFqUFRdgOpIhIi3mBUTMHnt9TPR0bVGxKPpGdfkyH7JieTrW32

```

But I don’t want a generated password, I want to use in this example “mypassword”. How could I set a specific one? I’ve tried also with OC\_PASS since some settings use that, same result.

Thks

---

<div class="post-metadata">

**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\
**Post date:** [March 8, 2025, 9:31am UTC](https://help.nextcloud.com/t/occ-useradd-custom-password-doesnt-work/219348/2 "2025-03-08T09:31:46Z")

</div>

app password must be very long and random string and I don’t think there is an option to pre-populate the app password. [Examples](https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/occ_command.html#user-commands) show how to provide a password for user:add but not for an auth-token… I could also imagine the string `mypassword`doesn’t pass the password policy and the tool fallback to a default one. and definitely there is no good real reason to access predefined unsecure string as app password… so might be it is intentionally not implemented.

---

<div class="post-metadata">

**Author:** ![jtr](https://help.nextcloud.com/letter_avatar/jtr/32/5_5575768a8748004e209b776fc1b2916d.png) [@jtr](https://help.nextcloud.com/u/jtr)\
**Post date:** [March 8, 2025, 3:43pm UTC](https://help.nextcloud.com/t/occ-useradd-custom-password-doesnt-work/219348/3 "2025-03-08T15:43:36Z")

</div>

> [@zx81](#):
>
> But I don’t want a generated password, I want to use in this example “mypassword”.

It’s a little confusing, but that parameter - when used in this particular context - isn’t used to specify a custom app password itself. It’s used to specify the login password that gets embedded within the app password token itself.

> <https://github.com/nextcloud/server/blob/f45d98bf00772c62e992ea7b76b56df4f99d6128/core/Command/User/AuthTokens/Add.php#L80-L82>

---

<div class="post-metadata">

**Author:** ![system](https://help.nextcloud.com/user_avatar/help.nextcloud.com/system/32/29333_2.png) [@system](https://help.nextcloud.com/u/system)\
**Post date:** [June 6, 2025, 3:43pm UTC](https://help.nextcloud.com/t/occ-useradd-custom-password-doesnt-work/219348/4 "2025-06-06T15:43:57Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.