From b0832e3be02b111ae40157244ce50b4baea9212e Mon Sep 17 00:00:00 2001
From: Stefan Majer <stefan.majer@f-i-ts.de>
Date: Sun, 28 Jun 2026 17:38:10 +0200
Subject: [PATCH] Allow creating multiple tokens with one request

---
 doc/index.html                           |  64 +++++++++++++
 go/metalstack/admin/v2/token.pb.go       | 110 +++++++++++++++++------
 js/metalstack/admin/v2/token_pb.d.ts     |  21 +++++
 js/metalstack/admin/v2/token_pb.js       |   7 +-
 js/metalstack/admin/v2/token_pb.ts       |  24 ++++-
 proto/metalstack/admin/v2/token.proto    |   7 ++
 python/metalstack/admin/v2/token_pb2.py  |  12 ++-
 python/metalstack/admin/v2/token_pb2.pyi |  13 +++
 8 files changed, 226 insertions(+), 32 deletions(-)

diff --git a/doc/index.html b/doc/index.html
index 21a980e9..9024647d 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -2329,6 +2329,14 @@ <h2>Table of Contents</h2>
             <a href="#metalstack%2fadmin%2fv2%2ftoken.proto">metalstack/admin/v2/token.proto</a>
             <ul>
               
+                <li>
+                  <a href="#metalstack.admin.v2.TokenServiceCreateMultiRequest"><span class="badge">M</span>TokenServiceCreateMultiRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.admin.v2.TokenServiceCreateMultiRequest.TokenCreateRequestsEntry"><span class="badge">M</span>TokenServiceCreateMultiRequest.TokenCreateRequestsEntry</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.admin.v2.TokenServiceCreateRequest"><span class="badge">M</span>TokenServiceCreateRequest</a>
                 </li>
@@ -19213,6 +19221,62 @@ <h2 id="metalstack/admin/v2/token.proto">metalstack/admin/v2/token.proto</h2><a
       <p></p>
 
       
+        <h3 id="metalstack.admin.v2.TokenServiceCreateMultiRequest">TokenServiceCreateMultiRequest</h3>
+        <p>TokenServiceCreateMultiRequest is the request payload for creating multiple tokens.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>token_create_requests</td>
+                  <td><a href="#metalstack.admin.v2.TokenServiceCreateMultiRequest.TokenCreateRequestsEntry">TokenServiceCreateMultiRequest.TokenCreateRequestsEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>TokenCreateRequests which map a destination name to a token create request.
+this can be used to create tokens for multiple purposes at once. </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.admin.v2.TokenServiceCreateMultiRequest.TokenCreateRequestsEntry">TokenServiceCreateMultiRequest.TokenCreateRequestsEntry</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>key</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value</td>
+                  <td><a href="#metalstack.admin.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="metalstack.admin.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</h3>
         <p>TokenServiceCreateRequest is the request payload for creating a token.</p>
 
diff --git a/go/metalstack/admin/v2/token.pb.go b/go/metalstack/admin/v2/token.pb.go
index c5ad5f0c..d5bf9006 100644
--- a/go/metalstack/admin/v2/token.pb.go
+++ b/go/metalstack/admin/v2/token.pb.go
@@ -317,6 +317,53 @@ func (x *TokenServiceCreateResponse) GetSecret() string {
 	return ""
 }
 
+// TokenServiceCreateMultiRequest is the request payload for creating multiple tokens.
+type TokenServiceCreateMultiRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// TokenCreateRequests which map a destination name to a token create request.
+	// this can be used to create tokens for multiple purposes at once.
+	TokenCreateRequests map[string]*TokenServiceCreateRequest `protobuf:"bytes,2,rep,name=token_create_requests,json=tokenCreateRequests,proto3" json:"token_create_requests,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
+}
+
+func (x *TokenServiceCreateMultiRequest) Reset() {
+	*x = TokenServiceCreateMultiRequest{}
+	mi := &file_metalstack_admin_v2_token_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TokenServiceCreateMultiRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TokenServiceCreateMultiRequest) ProtoMessage() {}
+
+func (x *TokenServiceCreateMultiRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_token_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TokenServiceCreateMultiRequest.ProtoReflect.Descriptor instead.
+func (*TokenServiceCreateMultiRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_token_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *TokenServiceCreateMultiRequest) GetTokenCreateRequests() map[string]*TokenServiceCreateRequest {
+	if x != nil {
+		return x.TokenCreateRequests
+	}
+	return nil
+}
+
 var File_metalstack_admin_v2_token_proto protoreflect.FileDescriptor
 
 const file_metalstack_admin_v2_token_proto_rawDesc = "" +
@@ -336,7 +383,12 @@ const file_metalstack_admin_v2_token_proto_rawDesc = "" +
 	"\x05_user\"d\n" +
 	"\x1aTokenServiceCreateResponse\x12.\n" +
 	"\x05token\x18\x01 \x01(\v2\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n" +
-	"\x06secret\x18\x02 \x01(\tR\x06secret2\xeb\x02\n" +
+	"\x06secret\x18\x02 \x01(\tR\x06secret\"\x9b\x02\n" +
+	"\x1eTokenServiceCreateMultiRequest\x12\x80\x01\n" +
+	"\x15token_create_requests\x18\x02 \x03(\v2L.metalstack.admin.v2.TokenServiceCreateMultiRequest.TokenCreateRequestsEntryR\x13tokenCreateRequests\x1av\n" +
+	"\x18TokenCreateRequestsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12D\n" +
+	"\x05value\x18\x02 \x01(\v2..metalstack.admin.v2.TokenServiceCreateRequestR\x05value:\x028\x012\xeb\x02\n" +
 	"\fTokenService\x12o\n" +
 	"\x04List\x12,.metalstack.admin.v2.TokenServiceListRequest\x1a-.metalstack.admin.v2.TokenServiceListResponse\"\n" +
 	"\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x12t\n" +
@@ -357,34 +409,38 @@ func file_metalstack_admin_v2_token_proto_rawDescGZIP() []byte {
 	return file_metalstack_admin_v2_token_proto_rawDescData
 }
 
-var file_metalstack_admin_v2_token_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_metalstack_admin_v2_token_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_metalstack_admin_v2_token_proto_goTypes = []any{
-	(*TokenServiceListRequest)(nil),      // 0: metalstack.admin.v2.TokenServiceListRequest
-	(*TokenServiceListResponse)(nil),     // 1: metalstack.admin.v2.TokenServiceListResponse
-	(*TokenServiceRevokeRequest)(nil),    // 2: metalstack.admin.v2.TokenServiceRevokeRequest
-	(*TokenServiceRevokeResponse)(nil),   // 3: metalstack.admin.v2.TokenServiceRevokeResponse
-	(*TokenServiceCreateRequest)(nil),    // 4: metalstack.admin.v2.TokenServiceCreateRequest
-	(*TokenServiceCreateResponse)(nil),   // 5: metalstack.admin.v2.TokenServiceCreateResponse
-	(*v2.TokenQuery)(nil),                // 6: metalstack.api.v2.TokenQuery
-	(*v2.Token)(nil),                     // 7: metalstack.api.v2.Token
-	(*v2.TokenServiceCreateRequest)(nil), // 8: metalstack.api.v2.TokenServiceCreateRequest
+	(*TokenServiceListRequest)(nil),        // 0: metalstack.admin.v2.TokenServiceListRequest
+	(*TokenServiceListResponse)(nil),       // 1: metalstack.admin.v2.TokenServiceListResponse
+	(*TokenServiceRevokeRequest)(nil),      // 2: metalstack.admin.v2.TokenServiceRevokeRequest
+	(*TokenServiceRevokeResponse)(nil),     // 3: metalstack.admin.v2.TokenServiceRevokeResponse
+	(*TokenServiceCreateRequest)(nil),      // 4: metalstack.admin.v2.TokenServiceCreateRequest
+	(*TokenServiceCreateResponse)(nil),     // 5: metalstack.admin.v2.TokenServiceCreateResponse
+	(*TokenServiceCreateMultiRequest)(nil), // 6: metalstack.admin.v2.TokenServiceCreateMultiRequest
+	nil,                                    // 7: metalstack.admin.v2.TokenServiceCreateMultiRequest.TokenCreateRequestsEntry
+	(*v2.TokenQuery)(nil),                  // 8: metalstack.api.v2.TokenQuery
+	(*v2.Token)(nil),                       // 9: metalstack.api.v2.Token
+	(*v2.TokenServiceCreateRequest)(nil),   // 10: metalstack.api.v2.TokenServiceCreateRequest
 }
 var file_metalstack_admin_v2_token_proto_depIdxs = []int32{
-	6, // 0: metalstack.admin.v2.TokenServiceListRequest.query:type_name -> metalstack.api.v2.TokenQuery
-	7, // 1: metalstack.admin.v2.TokenServiceListResponse.tokens:type_name -> metalstack.api.v2.Token
-	8, // 2: metalstack.admin.v2.TokenServiceCreateRequest.token_create_request:type_name -> metalstack.api.v2.TokenServiceCreateRequest
-	7, // 3: metalstack.admin.v2.TokenServiceCreateResponse.token:type_name -> metalstack.api.v2.Token
-	0, // 4: metalstack.admin.v2.TokenService.List:input_type -> metalstack.admin.v2.TokenServiceListRequest
-	2, // 5: metalstack.admin.v2.TokenService.Revoke:input_type -> metalstack.admin.v2.TokenServiceRevokeRequest
-	4, // 6: metalstack.admin.v2.TokenService.Create:input_type -> metalstack.admin.v2.TokenServiceCreateRequest
-	1, // 7: metalstack.admin.v2.TokenService.List:output_type -> metalstack.admin.v2.TokenServiceListResponse
-	3, // 8: metalstack.admin.v2.TokenService.Revoke:output_type -> metalstack.admin.v2.TokenServiceRevokeResponse
-	5, // 9: metalstack.admin.v2.TokenService.Create:output_type -> metalstack.admin.v2.TokenServiceCreateResponse
-	7, // [7:10] is the sub-list for method output_type
-	4, // [4:7] is the sub-list for method input_type
-	4, // [4:4] is the sub-list for extension type_name
-	4, // [4:4] is the sub-list for extension extendee
-	0, // [0:4] is the sub-list for field type_name
+	8,  // 0: metalstack.admin.v2.TokenServiceListRequest.query:type_name -> metalstack.api.v2.TokenQuery
+	9,  // 1: metalstack.admin.v2.TokenServiceListResponse.tokens:type_name -> metalstack.api.v2.Token
+	10, // 2: metalstack.admin.v2.TokenServiceCreateRequest.token_create_request:type_name -> metalstack.api.v2.TokenServiceCreateRequest
+	9,  // 3: metalstack.admin.v2.TokenServiceCreateResponse.token:type_name -> metalstack.api.v2.Token
+	7,  // 4: metalstack.admin.v2.TokenServiceCreateMultiRequest.token_create_requests:type_name -> metalstack.admin.v2.TokenServiceCreateMultiRequest.TokenCreateRequestsEntry
+	4,  // 5: metalstack.admin.v2.TokenServiceCreateMultiRequest.TokenCreateRequestsEntry.value:type_name -> metalstack.admin.v2.TokenServiceCreateRequest
+	0,  // 6: metalstack.admin.v2.TokenService.List:input_type -> metalstack.admin.v2.TokenServiceListRequest
+	2,  // 7: metalstack.admin.v2.TokenService.Revoke:input_type -> metalstack.admin.v2.TokenServiceRevokeRequest
+	4,  // 8: metalstack.admin.v2.TokenService.Create:input_type -> metalstack.admin.v2.TokenServiceCreateRequest
+	1,  // 9: metalstack.admin.v2.TokenService.List:output_type -> metalstack.admin.v2.TokenServiceListResponse
+	3,  // 10: metalstack.admin.v2.TokenService.Revoke:output_type -> metalstack.admin.v2.TokenServiceRevokeResponse
+	5,  // 11: metalstack.admin.v2.TokenService.Create:output_type -> metalstack.admin.v2.TokenServiceCreateResponse
+	9,  // [9:12] is the sub-list for method output_type
+	6,  // [6:9] is the sub-list for method input_type
+	6,  // [6:6] is the sub-list for extension type_name
+	6,  // [6:6] is the sub-list for extension extendee
+	0,  // [0:6] is the sub-list for field type_name
 }
 
 func init() { file_metalstack_admin_v2_token_proto_init() }
@@ -399,7 +455,7 @@ func file_metalstack_admin_v2_token_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_admin_v2_token_proto_rawDesc), len(file_metalstack_admin_v2_token_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/js/metalstack/admin/v2/token_pb.d.ts b/js/metalstack/admin/v2/token_pb.d.ts
index 17280c88..aa750dac 100644
--- a/js/metalstack/admin/v2/token_pb.d.ts
+++ b/js/metalstack/admin/v2/token_pb.d.ts
@@ -124,6 +124,27 @@ export type TokenServiceCreateResponse = Message<"metalstack.admin.v2.TokenServi
  * Use `create(TokenServiceCreateResponseSchema)` to create a new message.
  */
 export declare const TokenServiceCreateResponseSchema: GenMessage<TokenServiceCreateResponse>;
+/**
+ * TokenServiceCreateMultiRequest is the request payload for creating multiple tokens.
+ *
+ * @generated from message metalstack.admin.v2.TokenServiceCreateMultiRequest
+ */
+export type TokenServiceCreateMultiRequest = Message<"metalstack.admin.v2.TokenServiceCreateMultiRequest"> & {
+    /**
+     * TokenCreateRequests which map a destination name to a token create request.
+     * this can be used to create tokens for multiple purposes at once.
+     *
+     * @generated from field: map<string, metalstack.admin.v2.TokenServiceCreateRequest> token_create_requests = 2;
+     */
+    tokenCreateRequests: {
+        [key: string]: TokenServiceCreateRequest;
+    };
+};
+/**
+ * Describes the message metalstack.admin.v2.TokenServiceCreateMultiRequest.
+ * Use `create(TokenServiceCreateMultiRequestSchema)` to create a new message.
+ */
+export declare const TokenServiceCreateMultiRequestSchema: GenMessage<TokenServiceCreateMultiRequest>;
 /**
  * TokenService provides token management operations.
  *
diff --git a/js/metalstack/admin/v2/token_pb.js b/js/metalstack/admin/v2/token_pb.js
index 6c33a770..406552bd 100644
--- a/js/metalstack/admin/v2/token_pb.js
+++ b/js/metalstack/admin/v2/token_pb.js
@@ -9,7 +9,7 @@ import { file_metalstack_api_v2_token } from "../../api/v2/token_pb";
 /**
  * Describes the file metalstack/admin/v2/token.proto.
  */
-export const file_metalstack_admin_v2_token = /*@__PURE__*/ fileDesc("Ch9tZXRhbHN0YWNrL2FkbWluL3YyL3Rva2VuLnByb3RvEhNtZXRhbHN0YWNrLmFkbWluLnYyIkcKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0EiwKBXF1ZXJ5GAEgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5RdWVyeSJEChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USKAoGdG9rZW5zGAEgAygLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iTgoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARIZCgR1c2VyGAIgASgJQgu6SAhyBvizrrECASIcChpUb2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSKQAQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIeCgR1c2VyGAEgASgJQgu6SAhyBvizrrECAUgAiAEBEkoKFHRva2VuX2NyZWF0ZV9yZXF1ZXN0GAIgASgLMiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdEIHCgVfdXNlciJVChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCTLrAgoMVG9rZW5TZXJ2aWNlEm8KBExpc3QSLC5tZXRhbHN0YWNrLmFkbWluLnYyLlRva2VuU2VydmljZUxpc3RSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCtLzGAIBAuDzGAESdAoGUmV2b2tlEi4ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi8ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSIJ0vMYAQHg8xgBEnQKBkNyZWF0ZRIuLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBovLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiCdLzGAEB4PMYAULOAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCClRva2VuUHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hZG1pbi92MjthZG1pbnYyogIDTUFYqgITTWV0YWxzdGFjay5BZG1pbi5WMsoCE01ldGFsc3RhY2tcQWRtaW5cVjLiAh9NZXRhbHN0YWNrXEFkbWluXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6QWRtaW46OlYyYgZwcm90bzM", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_token]);
+export const file_metalstack_admin_v2_token = /*@__PURE__*/ fileDesc("Ch9tZXRhbHN0YWNrL2FkbWluL3YyL3Rva2VuLnByb3RvEhNtZXRhbHN0YWNrLmFkbWluLnYyIkcKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0EiwKBXF1ZXJ5GAEgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5RdWVyeSJEChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USKAoGdG9rZW5zGAEgAygLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iTgoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARIZCgR1c2VyGAIgASgJQgu6SAhyBvizrrECASIcChpUb2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSKQAQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIeCgR1c2VyGAEgASgJQgu6SAhyBvizrrECAUgAiAEBEkoKFHRva2VuX2NyZWF0ZV9yZXF1ZXN0GAIgASgLMiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdEIHCgVfdXNlciJVChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCSL5AQoeVG9rZW5TZXJ2aWNlQ3JlYXRlTXVsdGlSZXF1ZXN0EmsKFXRva2VuX2NyZWF0ZV9yZXF1ZXN0cxgCIAMoCzJMLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlTXVsdGlSZXF1ZXN0LlRva2VuQ3JlYXRlUmVxdWVzdHNFbnRyeRpqChhUb2tlbkNyZWF0ZVJlcXVlc3RzRW50cnkSCwoDa2V5GAEgASgJEj0KBXZhbHVlGAIgASgLMi4ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0OgI4ATLrAgoMVG9rZW5TZXJ2aWNlEm8KBExpc3QSLC5tZXRhbHN0YWNrLmFkbWluLnYyLlRva2VuU2VydmljZUxpc3RSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCtLzGAIBAuDzGAESdAoGUmV2b2tlEi4ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi8ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSIJ0vMYAQHg8xgBEnQKBkNyZWF0ZRIuLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBovLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiCdLzGAEB4PMYAULOAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCClRva2VuUHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hZG1pbi92MjthZG1pbnYyogIDTUFYqgITTWV0YWxzdGFjay5BZG1pbi5WMsoCE01ldGFsc3RhY2tcQWRtaW5cVjLiAh9NZXRhbHN0YWNrXEFkbWluXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6QWRtaW46OlYyYgZwcm90bzM", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_token]);
 /**
  * Describes the message metalstack.admin.v2.TokenServiceListRequest.
  * Use `create(TokenServiceListRequestSchema)` to create a new message.
@@ -40,6 +40,11 @@ export const TokenServiceCreateRequestSchema = /*@__PURE__*/ messageDesc(file_me
  * Use `create(TokenServiceCreateResponseSchema)` to create a new message.
  */
 export const TokenServiceCreateResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_token, 5);
+/**
+ * Describes the message metalstack.admin.v2.TokenServiceCreateMultiRequest.
+ * Use `create(TokenServiceCreateMultiRequestSchema)` to create a new message.
+ */
+export const TokenServiceCreateMultiRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_token, 6);
 /**
  * TokenService provides token management operations.
  *
diff --git a/js/metalstack/admin/v2/token_pb.ts b/js/metalstack/admin/v2/token_pb.ts
index 3e7d2910..7cd15cb4 100644
--- a/js/metalstack/admin/v2/token_pb.ts
+++ b/js/metalstack/admin/v2/token_pb.ts
@@ -15,7 +15,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file metalstack/admin/v2/token.proto.
  */
 export const file_metalstack_admin_v2_token: GenFile = /*@__PURE__*/
-  fileDesc("Ch9tZXRhbHN0YWNrL2FkbWluL3YyL3Rva2VuLnByb3RvEhNtZXRhbHN0YWNrLmFkbWluLnYyIkcKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0EiwKBXF1ZXJ5GAEgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5RdWVyeSJEChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USKAoGdG9rZW5zGAEgAygLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iTgoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARIZCgR1c2VyGAIgASgJQgu6SAhyBvizrrECASIcChpUb2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSKQAQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIeCgR1c2VyGAEgASgJQgu6SAhyBvizrrECAUgAiAEBEkoKFHRva2VuX2NyZWF0ZV9yZXF1ZXN0GAIgASgLMiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdEIHCgVfdXNlciJVChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCTLrAgoMVG9rZW5TZXJ2aWNlEm8KBExpc3QSLC5tZXRhbHN0YWNrLmFkbWluLnYyLlRva2VuU2VydmljZUxpc3RSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCtLzGAIBAuDzGAESdAoGUmV2b2tlEi4ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi8ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSIJ0vMYAQHg8xgBEnQKBkNyZWF0ZRIuLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBovLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiCdLzGAEB4PMYAULOAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCClRva2VuUHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hZG1pbi92MjthZG1pbnYyogIDTUFYqgITTWV0YWxzdGFjay5BZG1pbi5WMsoCE01ldGFsc3RhY2tcQWRtaW5cVjLiAh9NZXRhbHN0YWNrXEFkbWluXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6QWRtaW46OlYyYgZwcm90bzM", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_token]);
+  fileDesc("Ch9tZXRhbHN0YWNrL2FkbWluL3YyL3Rva2VuLnByb3RvEhNtZXRhbHN0YWNrLmFkbWluLnYyIkcKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0EiwKBXF1ZXJ5GAEgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5RdWVyeSJEChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USKAoGdG9rZW5zGAEgAygLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iTgoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARIZCgR1c2VyGAIgASgJQgu6SAhyBvizrrECASIcChpUb2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSKQAQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIeCgR1c2VyGAEgASgJQgu6SAhyBvizrrECAUgAiAEBEkoKFHRva2VuX2NyZWF0ZV9yZXF1ZXN0GAIgASgLMiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdEIHCgVfdXNlciJVChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCSL5AQoeVG9rZW5TZXJ2aWNlQ3JlYXRlTXVsdGlSZXF1ZXN0EmsKFXRva2VuX2NyZWF0ZV9yZXF1ZXN0cxgCIAMoCzJMLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlTXVsdGlSZXF1ZXN0LlRva2VuQ3JlYXRlUmVxdWVzdHNFbnRyeRpqChhUb2tlbkNyZWF0ZVJlcXVlc3RzRW50cnkSCwoDa2V5GAEgASgJEj0KBXZhbHVlGAIgASgLMi4ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0OgI4ATLrAgoMVG9rZW5TZXJ2aWNlEm8KBExpc3QSLC5tZXRhbHN0YWNrLmFkbWluLnYyLlRva2VuU2VydmljZUxpc3RSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCtLzGAIBAuDzGAESdAoGUmV2b2tlEi4ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi8ubWV0YWxzdGFjay5hZG1pbi52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSIJ0vMYAQHg8xgBEnQKBkNyZWF0ZRIuLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBovLm1ldGFsc3RhY2suYWRtaW4udjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiCdLzGAEB4PMYAULOAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCClRva2VuUHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hZG1pbi92MjthZG1pbnYyogIDTUFYqgITTWV0YWxzdGFjay5BZG1pbi5WMsoCE01ldGFsc3RhY2tcQWRtaW5cVjLiAh9NZXRhbHN0YWNrXEFkbWluXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6QWRtaW46OlYyYgZwcm90bzM", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_token]);
 
 /**
  * TokenServiceListRequest is the request payload for listing tokens.
@@ -158,6 +158,28 @@ export type TokenServiceCreateResponse = Message<"metalstack.admin.v2.TokenServi
 export const TokenServiceCreateResponseSchema: GenMessage<TokenServiceCreateResponse> = /*@__PURE__*/
   messageDesc(file_metalstack_admin_v2_token, 5);
 
+/**
+ * TokenServiceCreateMultiRequest is the request payload for creating multiple tokens.
+ *
+ * @generated from message metalstack.admin.v2.TokenServiceCreateMultiRequest
+ */
+export type TokenServiceCreateMultiRequest = Message<"metalstack.admin.v2.TokenServiceCreateMultiRequest"> & {
+  /**
+   * TokenCreateRequests which map a destination name to a token create request.
+   * this can be used to create tokens for multiple purposes at once.
+   *
+   * @generated from field: map<string, metalstack.admin.v2.TokenServiceCreateRequest> token_create_requests = 2;
+   */
+  tokenCreateRequests: { [key: string]: TokenServiceCreateRequest };
+};
+
+/**
+ * Describes the message metalstack.admin.v2.TokenServiceCreateMultiRequest.
+ * Use `create(TokenServiceCreateMultiRequestSchema)` to create a new message.
+ */
+export const TokenServiceCreateMultiRequestSchema: GenMessage<TokenServiceCreateMultiRequest> = /*@__PURE__*/
+  messageDesc(file_metalstack_admin_v2_token, 6);
+
 /**
  * TokenService provides token management operations.
  *
diff --git a/proto/metalstack/admin/v2/token.proto b/proto/metalstack/admin/v2/token.proto
index 6538d99a..d7ebb084 100644
--- a/proto/metalstack/admin/v2/token.proto
+++ b/proto/metalstack/admin/v2/token.proto
@@ -66,3 +66,10 @@ message TokenServiceCreateResponse {
   // Secret is the body if the JWT token, should be used in API requests as bearer token
   string secret = 2;
 }
+
+// TokenServiceCreateMultiRequest is the request payload for creating multiple tokens.
+message TokenServiceCreateMultiRequest {
+  // TokenCreateRequests which map a destination name to a token create request.
+  // this can be used to create tokens for multiple purposes at once.
+  map<string, TokenServiceCreateRequest> token_create_requests = 2;
+}
diff --git a/python/metalstack/admin/v2/token_pb2.py b/python/metalstack/admin/v2/token_pb2.py
index 431b542e..de187b76 100644
--- a/python/metalstack/admin/v2/token_pb2.py
+++ b/python/metalstack/admin/v2/token_pb2.py
@@ -28,7 +28,7 @@
 from metalstack.api.v2 import token_pb2 as metalstack_dot_api_dot_v2_dot_token__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/admin/v2/token.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1dmetalstack/api/v2/token.proto\"N\n\x17TokenServiceListRequest\x12\x33\n\x05query\x18\x01 \x01(\x0b\x32\x1d.metalstack.api.v2.TokenQueryR\x05query\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"Z\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1f\n\x04user\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01R\x04user\"\x1c\n\x1aTokenServiceRevokeResponse\"\xaa\x01\n\x19TokenServiceCreateRequest\x12$\n\x04user\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01H\x00R\x04user\x88\x01\x01\x12^\n\x14token_create_request\x18\x02 \x01(\x0b\x32,.metalstack.api.v2.TokenServiceCreateRequestR\x12tokenCreateRequestB\x07\n\x05_user\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret2\xeb\x02\n\x0cTokenService\x12o\n\x04List\x12,.metalstack.admin.v2.TokenServiceListRequest\x1a-.metalstack.admin.v2.TokenServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x12t\n\x06Revoke\x12..metalstack.admin.v2.TokenServiceRevokeRequest\x1a/.metalstack.admin.v2.TokenServiceRevokeResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12t\n\x06\x43reate\x12..metalstack.admin.v2.TokenServiceCreateRequest\x1a/.metalstack.admin.v2.TokenServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x42\xce\x01\n\x17\x63om.metalstack.admin.v2B\nTokenProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/admin/v2/token.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1dmetalstack/api/v2/token.proto\"N\n\x17TokenServiceListRequest\x12\x33\n\x05query\x18\x01 \x01(\x0b\x32\x1d.metalstack.api.v2.TokenQueryR\x05query\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"Z\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1f\n\x04user\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01R\x04user\"\x1c\n\x1aTokenServiceRevokeResponse\"\xaa\x01\n\x19TokenServiceCreateRequest\x12$\n\x04user\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01H\x00R\x04user\x88\x01\x01\x12^\n\x14token_create_request\x18\x02 \x01(\x0b\x32,.metalstack.api.v2.TokenServiceCreateRequestR\x12tokenCreateRequestB\x07\n\x05_user\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\x9b\x02\n\x1eTokenServiceCreateMultiRequest\x12\x80\x01\n\x15token_create_requests\x18\x02 \x03(\x0b\x32L.metalstack.admin.v2.TokenServiceCreateMultiRequest.TokenCreateRequestsEntryR\x13tokenCreateRequests\x1av\n\x18TokenCreateRequestsEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x44\n\x05value\x18\x02 \x01(\x0b\x32..metalstack.admin.v2.TokenServiceCreateRequestR\x05value:\x02\x38\x01\x32\xeb\x02\n\x0cTokenService\x12o\n\x04List\x12,.metalstack.admin.v2.TokenServiceListRequest\x1a-.metalstack.admin.v2.TokenServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x12t\n\x06Revoke\x12..metalstack.admin.v2.TokenServiceRevokeRequest\x1a/.metalstack.admin.v2.TokenServiceRevokeResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12t\n\x06\x43reate\x12..metalstack.admin.v2.TokenServiceCreateRequest\x1a/.metalstack.admin.v2.TokenServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x42\xce\x01\n\x17\x63om.metalstack.admin.v2B\nTokenProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -42,6 +42,8 @@
   _globals['_TOKENSERVICEREVOKEREQUEST'].fields_by_name['user']._serialized_options = b'\272H\010r\006\370\263\256\261\002\001'
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['user']._loaded_options = None
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['user']._serialized_options = b'\272H\010r\006\370\263\256\261\002\001'
+  _globals['_TOKENSERVICECREATEMULTIREQUEST_TOKENCREATEREQUESTSENTRY']._loaded_options = None
+  _globals['_TOKENSERVICECREATEMULTIREQUEST_TOKENCREATEREQUESTSENTRY']._serialized_options = b'8\001'
   _globals['_TOKENSERVICE'].methods_by_name['List']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['List']._serialized_options = b'\322\363\030\002\001\002\340\363\030\001'
   _globals['_TOKENSERVICE'].methods_by_name['Revoke']._loaded_options = None
@@ -60,6 +62,10 @@
   _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=641
   _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=643
   _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=743
-  _globals['_TOKENSERVICE']._serialized_start=746
-  _globals['_TOKENSERVICE']._serialized_end=1109
+  _globals['_TOKENSERVICECREATEMULTIREQUEST']._serialized_start=746
+  _globals['_TOKENSERVICECREATEMULTIREQUEST']._serialized_end=1029
+  _globals['_TOKENSERVICECREATEMULTIREQUEST_TOKENCREATEREQUESTSENTRY']._serialized_start=911
+  _globals['_TOKENSERVICECREATEMULTIREQUEST_TOKENCREATEREQUESTSENTRY']._serialized_end=1029
+  _globals['_TOKENSERVICE']._serialized_start=1032
+  _globals['_TOKENSERVICE']._serialized_end=1395
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/admin/v2/token_pb2.pyi b/python/metalstack/admin/v2/token_pb2.pyi
index 5902b33a..547ca7c4 100644
--- a/python/metalstack/admin/v2/token_pb2.pyi
+++ b/python/metalstack/admin/v2/token_pb2.pyi
@@ -49,3 +49,16 @@ class TokenServiceCreateResponse(_message.Message):
     token: _token_pb2.Token
     secret: str
     def __init__(self, token: _Optional[_Union[_token_pb2.Token, _Mapping]] = ..., secret: _Optional[str] = ...) -> None: ...
+
+class TokenServiceCreateMultiRequest(_message.Message):
+    __slots__ = ("token_create_requests",)
+    class TokenCreateRequestsEntry(_message.Message):
+        __slots__ = ("key", "value")
+        KEY_FIELD_NUMBER: _ClassVar[int]
+        VALUE_FIELD_NUMBER: _ClassVar[int]
+        key: str
+        value: TokenServiceCreateRequest
+        def __init__(self, key: _Optional[str] = ..., value: _Optional[_Union[TokenServiceCreateRequest, _Mapping]] = ...) -> None: ...
+    TOKEN_CREATE_REQUESTS_FIELD_NUMBER: _ClassVar[int]
+    token_create_requests: _containers.MessageMap[str, TokenServiceCreateRequest]
+    def __init__(self, token_create_requests: _Optional[_Mapping[str, TokenServiceCreateRequest]] = ...) -> None: ...