2026-07

A hand-signed token was correctly rejected

ArgoCD checks a token's jti against a registry, not its issue time — and the subject needs an ":apiKey" suffix the account name alone doesn't have.

Background

The console needed live ArgoCD data, but the only documented admin credential no longer authenticated, and a scoped read-only account had already been provisioned with no way yet to mint it a token.

Path

Symptom: No live ArgoCD data
Assumption: hand-sign a token, skip the password
Measurement: inspect the "revoked" check
Decision: reset password, use the real endpoint

Response

Reset the admin password through the already-documented bcrypt-patch technique, then generate the token through ArgoCD's own account-token endpoint instead of guessing the claim shape further.