I would like to use PMP API user to fetch resource passwords for any deployment scripts, but I do not want to hard code the PMP API token into my scripts. I was planning to use a 2 API token system where tokens validity is overlapping, so I could always script to fetch the API token for next week and retire the old token after this week. I could not find any inbuilt features to support this idea, so was wondering that what is the best practice for rotating API tokens for PMP API users? Password rotation seems to be only available for resource groups, but I cannot add a PMP API user to a resource group. So any best practice guides would be helpful.

Thanks,

-Ilpo-