This article aims to explain why admins may notice events in the System log with "Create API token" where the actor is an end-user who does not have administrator permission, or specifically does not have permission to create API tokens.

However, the event for that actor still shows the following:

- eventType eq "system.api_token.create"

• System Log
• API
• Okta Mobile

This event type is generated when end-users access their accounts via Okta Mobile App.

This does not mean this user created an API token within the Okta organization. Those token creation events appear when users log in to the Okta Mobile App on their mobile devices. A session token is generated, and the system log captures it as a token creation event. Admins can also see in the next event in the syslog where the user logged in to Okta, and the device used is Mobile.

This session token does not appear in the API tokens menu, does not grant any additional permissions, and is not an API token with administrative privileges.