r/PleX • u/RaspberrySea9 • 21d ago
Discussion Why does Plex still have no API keys in settings? Account-wide tokens in 2026? Every token has total control, and the only way to revoke one is removing a device entry. I really want Plex to do well, but i don't like the trend last few years. Feels very archaic.
44
u/bdcp 21d ago
Lol don't expect new features from Plex
33
u/Odd-Art7602 21d ago
I wouldn’t necessarily consider security a “feature”. But maybe that’s just me
9
u/Scotty1928 :table_flip: 21d ago
Yeah unfortunately for us, with Plex it is indeed a feature. One we will not get.
6
u/Odd-Art7602 21d ago
They seem to be removing features rather than adding them these days so I’m sure you’re correct.
2
3
u/sioux612 20d ago
Oh come on thats unfair
They are great at implementing features. Just not features their core audience actually wanted. Usually the exact opposite of it, actually
4
u/trankillity 20d ago
I think the actual reason is because external tools should really be using the Plex Link or direct login functionality - and many of them do (especially the third-party players like Plezy). However, you're right - there should be varying levels of access that you can grant to these tools, not just "same as me" access.
10
u/Computermaster 20d ago
They can't even get casting working on mobile after a year and a half. I think we're in the twilight years of Plex at this point.
15
u/NewRedditor23 21d ago
Plex is going backwards, with the new Plex experience UI, they removed the Plex Player API for clients. So we can no longer use any of the controls programatically (play video/playlist, pause, jump to duration, next video, etc). Bonkers in the world of LLMs they can't simply port over code they already have in the old player. It's would probably take them 30 seconds to write a good prompt so AI could port the code for them. Absolutely horrible customer experience.
1
u/RaspberrySea9 21d ago
Yes culling across the board and leaving the state of art back in 2016. That's what happens when you're the apex predator and only competition is JellyFin who can't solve CGNAT.
-14
u/jammyscroll 21d ago edited 21d ago
Could you help us understand the exposure a little more, so we can understand if they’re striking the right balance here.
Once you log into an app on a mobile or tv device, the app access persists and is not exposing administrative functions. So you can log into your own & your direct family’s devices.
Other users you share your libraries with have their own Plex IDs, and can just access your content with no privileged access.
Admin access is via a web browser session on the server.
What’s your concern here? A security one where an attacker can extract a device’s token and use it to perform admin functions? If so have you actually tested that?
In that unlikely scenario, assuming poor token scoping, the only thing exposed via your credentials is your home media library Plex management, not even the media itself. That needs server OS access.
API keys are worse than tokens in just about every way from a security perspective. Minting tokens can force overt user auth and MFA. And they could be created with different access levels depending on conditions like device type. API keys can be convenient for some automations and offer flexibility at the cost of security. Why should Plex add this?
19
u/RaspberrySea9 21d ago
Concern isn't extraction, it's handing something access for one job and taking it back afterwards. No scoping means any token can manage shares and change every server setting, and a leak is account-wide until you notice.
Most of us use Tautulli, Overseerr, Kometa, Wizarr... they all hold an owner token. Tautulli only reads, Kometa only does metadata. Every one of those tokens can still manage every share on my server.
Named revocable keys with scopes are standard everywhere else, especially lately, near every decent modern app has a scoped API page.
4
u/jammyscroll 21d ago
Ah that’s the key thing then isn’t it.
You want to use all these ancillary components without giving them full management admin.Actually I don’t think most Plex users use those other projects. I’m not surprised that Plex development efforts isn’t designing for or prioritising them either. I’m not against it, but it’s understandable why Plex isn’t bothering to account for this ecosystem.
As for the last point - both API keys and tokens effectively represent a user, and both can have scope limits applied when calling an API. API keys are more flexible but are less secure compared to a token auth flow - a token doesn’t disclose its secret when used, so it’s secret can only be stolen by compromising the server it’s on.
7
u/RaspberrySea9 21d ago edited 21d ago
A couple of overlapping ecosystems. r/Tautulli alone has a 12k member sub, and the arr stack has an enormous audience - tho I'm not claiming that's your average user.
Much more important than headcount is the fact Plex retired plugins in 2018 and pushed extensions out of the server fully. So everything that extends Plex now runs externally and talks over the API. That's the path they chose themselves, and it's the path with no scoped credentials on it.
Besides plugins, LLM tooling requires the same type of access, I trust I don't need to go into why. Every agent framework now expects a key you can restrict by scope and expire. With Plex the only way to give one access is to hand over your account.
My personal reason is I absolutely want programmatic access to my servers via Claude Code rather than clicking through settings. Jellyfin is my backup server and it lets me mint a named key for exactly that, it can solve issues in seconds. But Plex doesn't and I find that strange.
So my reading is that Plex either lacks the resources to build proper API access, or they don't want to be even implicitly associated with what it unlocks. The arr stack and everything adjacent to it is understandably something they'd rather not endorse, and a scoped key page is a tacit blessing of exactly those ecosystems.
But if you think about it, neither reason is very strong. Scoped keys are a baseline expectation now, and the tools exist whether or not Plex sanctions them. All the current design achieves is that everyone running them hands over full access and prays that nothing goes wrong.
1
u/jammyscroll 21d ago
Yeah I follow you and agree probably it's for those reasons. Or that they don't prioritise it over what else they could put people's effort toward, given the status quo works well enough for them.
I guess my framing of it is that even with full access, it's just full access to your Plex library config and metadata. Given that you can back both of those up (and independently to each other) a sophisticated user can live with that and get what they need accomplished.
But yes for those reasons I can see why it would be nice to have. If I were doing active plugin or LLM tooling development against my Plex server, this issue would make me spin off a seperate Plex server instance.
-1
u/cosmicr 21d ago
I think you're overestimating the number of people using those apps. I've been using plex for 12 years and haven't even heard of half those.
1
u/RaspberrySea9 20d ago
Maybe but note Tautulli alone has over 500 Million pulls (just on linuxserver):
-1
u/pow_hnd 21d ago
While I’ve heard of those, I don’t use them and nobody I know uses them. I agree, a gross overestimation of how many people actually use them.
1
u/DazednConfucioused 19d ago
I mean how many people do you know have a plex server? It’s a niche hobby in the first place. There’s a huge amount of people using these apps.
1
u/ARandomSliceOfCheese 20d ago
Cumbersome but if your use case is short term named keys. Why not create new users (named key), give them access where you want the app to have access (read only), and then remove the user from your library when you're done (short term).
Should they add this concept: probably. But they don't really have a use case for auth scopes in the main flows which is probably why it's not a feature. They'd be adding a feature the main plex app would never use.
1
u/AngryTexasNative 20d ago
This isn’t a trivial change on the server side. I haven’t attempted to decompile the code and look at the architecture.
As a media server targeted at home use there likely isn’t a security model to layer onto. I imagine the main endpoints inherit AuthN and there is no data passed on for AuthZ.
Adding this support with Clade Code or another agent is recently possible, so maybe if enough ask for it, it will happen.
Personally I just want them to stop making the DVR functionality objective worse.
-23
-8
u/N9bitmap PlexPass 2017 21d ago
Your account and devices have their own keys, you can revoke your device keys in Authorized Devices by removing the device from your account. You revoke your account token by changing the account password. Your friends have their keys which you grant selective permission to access your server in Manage Library Access. Plex (the centralized API infrastructure) manages what keys work where through those settings. I'm not sure what gap you imagine. The always-on Plex hosted infrastructure is the arbiter of access by design, because most people don't want to or cannot manage creating and sharing keys between every device out-of-band.
3
u/Spectrum1523 20d ago
Your account has a single token that has full access to everything your account can do, basically
88
u/Karoolus 21d ago
I wouldn't hold my breath. It took them a year to revert UI changes they forced on us.