# Seamless Auth0 Rocket.Chat Login in WebView: Workaround for users.createToken Deprecation?

**URL:** <https://forums.rocket.chat/t/seamless-auth0-rocket-chat-login-in-webview-workaround-for-users-createtoken-deprecation/22177>\
**Category:** Community Support\
**Tags:** projectideas, mobile, rocketchat-apps\
**Created:** [May 30, 2025, 5:33am UTC](https://forums.rocket.chat/t/seamless-auth0-rocket-chat-login-in-webview-workaround-for-users-createtoken-deprecation/22177 "2025-05-30T05:33:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TeeNuggetTa](https://avatars.discourse-cdn.com/v4/letter/t/ea5d25/32.png) [@TeeNuggetTa](https://forums.rocket.chat/u/TeeNuggetTa)\
**Post date:** [May 30, 2025, 5:33am UTC](https://forums.rocket.chat/t/seamless-auth0-rocket-chat-login-in-webview-workaround-for-users-createtoken-deprecation/22177/1 "2025-05-30T05:33:25Z")

</div>

We’re developing a React Native mobile application that uses Auth0 for authentication. Our goal is to allow users to open a Rocket.Chat WebView “already logged in”, without needing to manually authenticate again inside the WebView.

Since cookies and session data from the native app are not shared with the WebView, and Auth0’s token cannot be exchanged directly with Rocket.Chat for a session, we began exploring programmatic login options.

One approach we looked at was the deprecated endpoint:  
`POST /api/v1/users.createToken`

This endpoint appeared to solve our exact use case. It allowed an admin to generate a session token (`authToken`) for a user, which we could inject into the WebView via `localStorage.setItem('Meteor.loginToken', token)`, effectively logging the user in without interaction.

Unfortunately, we realized this endpoint is deprecated and scheduled for removal in v8.0.0. Additionally, it requires the `CREATE_TOKENS_FOR_USERS=true` environment variable to be set, which isn’t available on Rocket.Chat Cloud or SaaS-hosted instances.

We didn’t implement it fully (as the endpoint is deactivated by default), but we’re looking for “any modern, supported alternatives” that let a backend securely generate a usable Rocket.Chat session token “without knowing the user’s password”.

We’re aware of `/users.generatePersonalAccessToken`, but it doesn’t provide tokens that work for session-based login (they’re for API usage only).

Our end goal is:

- Authenticate a user in the React Native app (via Auth0)
- Open Rocket.Chat in a WebView
- Log the user in seamlessly (ideally via injected session or some kind of token exchange)

Is there an official or recommended alternative to `users.createToken` for this purpose?

---

<div class="post-metadata">

**Author:** ![reetp](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/reetp/32/5546_2.png) [@reetp](https://forums.rocket.chat/u/reetp)\
**Post date:** [May 30, 2025, 6:54am UTC](https://forums.rocket.chat/t/seamless-auth0-rocket-chat-login-in-webview-workaround-for-users-createtoken-deprecation/22177/2 "2025-05-30T06:54:53Z")

</div>

> [@TeeNuggetTa](#):
>
> users.createToken

See links here for why.

> <https://github.com/RocketChat/Rocket.Chat/issues/32722>
>
> Hello,
> 
> I want to generate and retrieve tokens of users as an admin, I investi…gated recent endpoints but I didn’t find a way to that. There was create users token endpoint but it is now deprecated. I wonder is there any alternative way to create token for users as an admin.
> 
> We want to use rocket.chat as a messaging backend for the application we are developing. Client applications will only connect to the application, the application itself will act as a middleware and can send messages on behalf of the relevant user when necessary.
> 
> Server Setup Information
> Version of Rocket.Chat Server: 6.9.2
> Operating System: Windows
> Deployment Method: docker
> Number of Running Instances: 1
> DB Replicaset Oplog:
> NodeJS Version: 14.21.3
> MongoDB Version: 6.0.13
> Proxy: traefik
> Firewalls involved: No