Test 1 As an admin, enable web services and create an external service with an arbitrary shortname, e.g. externalservice . Create a user testuser with the password Testpass1! that is able to access that service (either by allowing all users to use the service, or by restricting the external service to that particular user). Grant the moodle/webservice:createtoken privilege to that user, e.g. by allowing it for the Authenticated user role. In the name of the user, create a token by visiting the URL $CFG->wwwroot/login/token.php?service=externalservice&username=testuser&password=Testpass1! and write down the resulting token. As an administrator, navigate to Site administration -> Plugins -> Web services -> Manage tokens. Verify that the token from #4 shows up, with first and last name of testuser in the "User" column and the username testuser in the "Creator" column. Still as an administrator, click "Add". Select testuser for "User" and externalservice for "Service" and click "Save changes" Verify that another token shows up, again with first and last name of testuser in the "User" column, but your administrator's username in the "Creator" column. Try deleting the first token (the one not created by the admin) Make sure the confirmation page makes sense with no errors and it is successfully deleted. Accounts with a suitable capability should be able to view or reset any webservice token. Test 2 Go to Site Administration > Users > Permissions > Assign system roles Assign the manager role to a user on your site (any besides admin or the testuser you created) Grant the moodle/webservice:createtoken privilege to that user, e.g. by allowing it for the Manager role. Grant the moodle/site:config privilege to that user, e.g. by allowing it for the Manager role. Log in as the user and go to to Site administration -> Plugins -> Web services -> Manage tokens. Make sure you can't see the token created in testuser's name Log out Log in as admin Make sure you can see the token created in testuser's name Copy the delete button url for that token Log in as the manager user Paste the url Make sure you get an error Test 3 Grant the moodle/webservice:managealltokens privilege to the manager user, e.g. by allowing it for the Manager role. Log in as the user and go to to Site administration -> Plugins -> Web services -> Manage tokens. Make sure you can see the tokens created in the admin user's name and can see the creator collumn Try to delete one Make sure you don't get an error Test 4 Download test.php attached to this issue Refresh the manage tokens page. Take note of the performance footer (DB reads and load time) Run php test.php It will create 10000 tokens Refresh the page. Make sure the number of DB reads and load time is not much higher The script will have printed out a command you can run to remove all the extra tokens to reset your site. You can run that