# Is JUPYTERHUB\_API\_TOKEN sensitive?

**URL:** <https://discourse.jupyter.org/t/is-jupyterhub-api-token-sensitive/35605>\
**Category:** JupyterHub\
**Tags:** jupyterhub\
**Created:** [May 26, 2025, 8:20am UTC](https://discourse.jupyter.org/t/is-jupyterhub-api-token-sensitive/35605 "2025-05-26T08:20:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![paolo](https://avatars.discourse-cdn.com/v4/letter/p/6f9a4e/32.png) [@paolo](https://discourse.jupyter.org/u/paolo)\
**Post date:** [May 26, 2025, 8:20am UTC](https://discourse.jupyter.org/t/is-jupyterhub-api-token-sensitive/35605/1 "2025-05-26T08:20:08Z")

</div>

I deployed Jupyterhub on a GKE cluster. From a notebook I executed an `!env` command, and looking at the environment variables I see `JUPYTERHUB_API_TOKEN` and `JPY_API_TOKEN`, which are identical. Are these sensitive? Could they be used maliciously? If so, is there a way to prevent them being exposed?

---

<div class="post-metadata">

**Author:** ![manics](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/manics/32/85_2.png) [@manics](https://discourse.jupyter.org/u/manics)\
**Post date:** [May 29, 2025, 2:45pm UTC](https://discourse.jupyter.org/t/is-jupyterhub-api-token-sensitive/35605/2 "2025-05-29T14:45:35Z")

</div>

`JUPYTERHUB_API_TOKEN` is required for the singleuser server to communicate with the hub. `JPY_API_TOKEN` is the old deprecated name that is keep for backwards compatibility and can be removed for modern servers.

Only the current user should have access to it, if it’s leaked then other potentially malicious entities would gain access to that user’s server, files, etc. In theory it could be removed from some user-facing components such as the kernel and terminal environments, but that would have to be done in Jupyter-server/lab/notebook, not in JupyterHub.

---

<div class="post-metadata">

**Author:** ![paolo](https://avatars.discourse-cdn.com/v4/letter/p/6f9a4e/32.png) [@paolo](https://discourse.jupyter.org/u/paolo)\
**Post date:** [May 30, 2025, 6:59am UTC](https://discourse.jupyter.org/t/is-jupyterhub-api-token-sensitive/35605/3 "2025-05-30T06:59:09Z")

</div>

Thank you, that’s helpful.