diff --git a/apps/server-nestjs/documentation/Modularisation-de-console-server/MODULARISATION-CARTOGRAPHIE.md b/apps/server-nestjs/documentation/Modularisation-de-console-server/MODULARISATION-CARTOGRAPHIE.md
index d9c306626..e9a927116 100644
--- a/apps/server-nestjs/documentation/Modularisation-de-console-server/MODULARISATION-CARTOGRAPHIE.md
+++ b/apps/server-nestjs/documentation/Modularisation-de-console-server/MODULARISATION-CARTOGRAPHIE.md
@@ -18,7 +18,7 @@ Cartographier l'ensemble des modules de l'application backend actuelle pour :
 
 | Decision | Choix |
 |----------|-------|
-| Approche migration | Bottom-up (feuilles d'abord, puis remontee vers les modules couples) |
+| Approche migration | Bottom-up (feuilles d'abord, puis remonttee vers les modules couples) |
 | Contrats API | Decorateurs NestJS natifs + class-validator (abandon de ts-rest) |
 | queries-index.ts | Supprime des le depart : chaque module NestJS possede ses propres queries Prisma |
 | Systeme d'evenements | `@nestjs/event-emitter` (remplacement progressif de `@cpn-console/hooks`) |
diff --git a/apps/server-nestjs/src/main.module.ts b/apps/server-nestjs/src/main.module.ts
index a2ef47eee..506bb48e1 100644
--- a/apps/server-nestjs/src/main.module.ts
+++ b/apps/server-nestjs/src/main.module.ts
@@ -1,5 +1,6 @@
 import { Module } from '@nestjs/common'
 import { ScheduleModule } from '@nestjs/schedule'
+import { AdminTokenModule } from './modules/admin-token/admin-token.module'
 import { DeploymentModule } from './modules/deployment/deployment.module'
 import { HealthzModule } from './modules/healthz/healthz.module'
 import { KeycloakModule } from './modules/keycloak/keycloak.module'
@@ -12,10 +13,12 @@ import { ProjectServicesModule } from './modules/project-services/project-servic
 import { ProjectModule } from './modules/project/project.module'
 import { ServiceChainModule } from './modules/service-chain/service-chain.module'
 import { SystemSettingsModule } from './modules/system-settings/system-settings.module'
+import { UserTokensModule } from './modules/user-tokens/user-tokens.module'
 import { VersionModule } from './modules/version/version.module'
 
 @Module({
   imports: [
+    AdminTokenModule,
     HealthzModule,
     KeycloakModule,
     ScheduleModule.forRoot(),
@@ -29,6 +32,7 @@ import { VersionModule } from './modules/version/version.module'
     ProjectRolesModule,
     LogModule,
     DeploymentModule,
+    UserTokensModule,
     VersionModule,
   ],
   controllers: [],
diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token.controller.ts b/apps/server-nestjs/src/modules/admin-token/admin-token.controller.ts
new file mode 100644
index 000000000..c9df04d82
--- /dev/null
+++ b/apps/server-nestjs/src/modules/admin-token/admin-token.controller.ts
@@ -0,0 +1,34 @@
+import { AdminTokenSchema } from '@cpn-console/shared'
+import { Body, Controller, Delete, Get, HttpCode, Inject, Param, Post, Query, UseGuards } from '@nestjs/common'
+import { RequireAdminPermission } from '../infrastructure/permission/user/user-admin-permission.decorator'
+import { UserGuard } from '../infrastructure/permission/user/user.guard'
+import { ZodValidationPipe } from '../infrastructure/pipe/zod-validation.pipe'
+import { AdminTokenService } from './admin-token.service'
+
+@Controller('api/v1/admin/tokens')
+@UseGuards(UserGuard)
+export class AdminTokenController {
+  constructor(@Inject(AdminTokenService) private readonly service: AdminTokenService) {}
+
+  @Get()
+  @RequireAdminPermission('ListAdminToken')
+  async list(@Query('withRevoked') withRevoked?: string) {
+    return this.service.list(withRevoked !== undefined && withRevoked !== 'false')
+  }
+
+  @Post()
+  @HttpCode(201)
+  @RequireAdminPermission('ManageAdminToken')
+  async create(
+    @Body(new ZodValidationPipe(AdminTokenSchema.pick({ name: true, permissions: true, expirationDate: true }).required())) data: { name: string, permissions: string, expirationDate: string | null },
+  ) {
+    return this.service.create(data)
+  }
+
+  @Delete(':tokenId')
+  @HttpCode(204)
+  @RequireAdminPermission('ManageAdminToken')
+  async revoke(@Param('tokenId') tokenId: string): Promise<void> {
+    return this.service.revoke(tokenId)
+  }
+}
diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token.module.ts b/apps/server-nestjs/src/modules/admin-token/admin-token.module.ts
new file mode 100644
index 000000000..176543d96
--- /dev/null
+++ b/apps/server-nestjs/src/modules/admin-token/admin-token.module.ts
@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common'
+import { InfrastructureModule } from '../infrastructure/infrastructure.module'
+import { AdminTokenController } from './admin-token.controller'
+import { AdminTokenService } from './admin-token.service'
+
+@Module({
+  imports: [InfrastructureModule],
+  controllers: [AdminTokenController],
+  providers: [AdminTokenService],
+  exports: [AdminTokenService],
+})
+export class AdminTokenModule {}
diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token.service.spec.ts b/apps/server-nestjs/src/modules/admin-token/admin-token.service.spec.ts
new file mode 100644
index 000000000..46cb36191
--- /dev/null
+++ b/apps/server-nestjs/src/modules/admin-token/admin-token.service.spec.ts
@@ -0,0 +1,121 @@
+import type { TestingModule } from '@nestjs/testing'
+import type { DeepMockProxy } from 'vitest-mock-extended'
+import { faker } from '@faker-js/faker'
+import { Test } from '@nestjs/testing'
+import { beforeEach, describe, expect, it } from 'vitest'
+import { mockDeep } from 'vitest-mock-extended'
+import { PrismaService } from '../infrastructure/database/prisma.service'
+import { AdminTokenService } from './admin-token.service'
+
+describe('adminTokenService', () => {
+  let module: TestingModule
+  let service: AdminTokenService
+  let prisma: DeepMockProxy<PrismaService>
+
+  beforeEach(async () => {
+    prisma = mockDeep<PrismaService>()
+
+    module = await Test.createTestingModule({
+      providers: [
+        AdminTokenService,
+        { provide: PrismaService, useValue: prisma },
+      ],
+    }).compile()
+
+    service = module.get(AdminTokenService)
+  })
+
+  describe('list', () => {
+    it('returns active tokens with permissions serialized as string', async () => {
+      const tokenId = faker.string.uuid()
+      const userId = faker.string.uuid()
+      prisma.adminToken.findMany.mockResolvedValue([{
+        id: tokenId,
+        name: 'my-token',
+        permissions: 4n,
+        lastUse: null,
+        expirationDate: null,
+        status: 'active' as const,
+        createdAt: new Date(),
+        userId,
+        hash: 'hash-1',
+      }])
+
+      const result = await service.list()
+
+      expect(prisma.adminToken.findMany).toHaveBeenCalled()
+      expect(result).toHaveLength(1)
+      expect(result[0].id).toBe(tokenId)
+      expect(result[0].permissions).toBe('4')
+    })
+
+    it('includes revoked tokens when withRevoked is true', async () => {
+      prisma.adminToken.findMany.mockResolvedValue([])
+
+      await service.list(true)
+
+      const callArgs = prisma.adminToken.findMany.mock.calls[0]?.[0]
+      expect(callArgs?.where).toEqual({ status: { in: ['active', 'revoked'] } })
+    })
+
+    it('filters to active only by default', async () => {
+      prisma.adminToken.findMany.mockResolvedValue([])
+
+      await service.list()
+
+      const callArgs = prisma.adminToken.findMany.mock.calls[0]?.[0]
+      expect(callArgs?.where).toEqual({ status: 'active' })
+    })
+  })
+
+  describe('create', () => {
+    it('throws BadRequestException if expirationDate is too soon', async () => {
+      const today = new Date()
+      await expect(service.create({ name: 'x', permissions: '4', expirationDate: today.toISOString() }))
+        .rejects.toThrow('Date d\'expiration trop courte')
+      expect(prisma.adminToken.create).not.toHaveBeenCalled()
+    })
+
+    it('returns created token with plaintext password and serialized permissions', async () => {
+      const tokenId = faker.string.uuid()
+      const botUserId = faker.string.uuid()
+      prisma.user.create.mockResolvedValue({ id: botUserId, firstName: 'Bot Admin', lastName: 'my-token', type: 'bot', email: 'x@bot.io' } as never)
+      prisma.adminToken.create.mockResolvedValue({
+        id: tokenId,
+        name: 'my-token',
+        permissions: 2n,
+        lastUse: null,
+        expirationDate: null,
+        status: 'active' as const,
+        createdAt: new Date(),
+        userId: botUserId,
+        hash: 'hash-2',
+      })
+
+      const result = await service.create({ name: 'my-token', permissions: '2', expirationDate: null })
+
+      expect(prisma.user.create).toHaveBeenCalled()
+      expect(prisma.adminToken.create).toHaveBeenCalled()
+      expect(result.id).toBe(tokenId)
+      expect(result.password).toBeTruthy()
+      expect(result.permissions).toBe('2')
+    })
+  })
+
+  describe('revoke', () => {
+    it('sets status to revoked and expiration date to now', async () => {
+      const tokenId = faker.string.uuid()
+      prisma.adminToken.updateMany.mockResolvedValue({ count: 1 } as never)
+
+      await service.revoke(tokenId)
+
+      expect(prisma.adminToken.updateMany).toHaveBeenCalledWith({
+        where: { id: tokenId },
+        data: {
+          status: 'revoked',
+          expirationDate: expect.any(Date) as Date,
+        },
+      })
+    })
+  })
+})
diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token.service.ts b/apps/server-nestjs/src/modules/admin-token/admin-token.service.ts
new file mode 100644
index 000000000..a4ed5bab3
--- /dev/null
+++ b/apps/server-nestjs/src/modules/admin-token/admin-token.service.ts
@@ -0,0 +1,117 @@
+import type { Prisma } from '@prisma/client'
+import { randomBytes, randomUUID, scrypt } from 'node:crypto'
+import { promisify } from 'node:util'
+import { generateRandomPassword, isAtLeastTomorrow } from '@cpn-console/shared'
+import { BadRequestException, Inject, Injectable, Logger } from '@nestjs/common'
+import { trace } from '@opentelemetry/api'
+import { PrismaService } from '../infrastructure/database/prisma.service'
+import { StartActiveSpan } from '../infrastructure/telemetry/telemetry.decorator'
+
+const scryptAsync = promisify(scrypt)
+
+@Injectable()
+export class AdminTokenService {
+  private readonly logger = new Logger(AdminTokenService.name)
+
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  @StartActiveSpan()
+  async list(withRevoked?: boolean) {
+    const span = trace.getActiveSpan()
+    this.logger.log(`adminToken.list requested (withRevoked=${withRevoked ?? false})`)
+    span?.setAttribute('adminToken.list.withRevoked', withRevoked ?? false)
+
+    const where: Prisma.AdminTokenWhereInput = withRevoked
+      ? { status: { in: ['active', 'revoked'] } }
+      : { status: 'active' }
+
+    const tokens = await this.prisma.adminToken.findMany({
+      omit: { hash: true },
+      include: { owner: true },
+      orderBy: [{ status: 'asc' }, { createdAt: 'asc' }],
+      where,
+    })
+
+    span?.setAttribute('adminToken.list.count', tokens.length)
+    this.logger.log(`adminToken.list completed (count=${tokens.length})`)
+
+    return tokens.map(({ permissions, ...token }) => ({
+      ...token,
+      permissions: permissions.toString(),
+    }))
+  }
+
+  @StartActiveSpan()
+  async create(data: { name: string, permissions: string, expirationDate?: string | null }) {
+    const span = trace.getActiveSpan()
+    span?.setAttribute('adminToken.create.name', data.name)
+    this.logger.log(`adminToken.create started (tokenName=${data.name})`)
+
+    if (data.expirationDate && !isAtLeastTomorrow(new Date(data.expirationDate))) {
+      this.logger.warn(`adminToken.create rejected (tokenName=${data.name}, reason=expirationTooSoon)`)
+      throw new BadRequestException('Date d\'expiration trop courte')
+    }
+
+    try {
+      const password = generateRandomPassword(48, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-')
+      const salt = randomBytes(16).toString('hex')
+      const derivedKey = await scryptAsync(password, salt, 64) as Buffer
+      const hash = `scrypt$${salt}$${derivedKey.toString('hex')}`
+      const botUserId = randomUUID()
+
+      await this.prisma.user.create({
+        data: {
+          firstName: 'Bot Admin',
+          lastName: data.name,
+          type: 'bot',
+          id: botUserId,
+          email: `${botUserId}@bot.io`,
+        },
+      })
+
+      const token = await this.prisma.adminToken.create({
+        data: {
+          ...data,
+          hash,
+          permissions: BigInt(data.permissions),
+          expirationDate: data.expirationDate ? new Date(data.expirationDate) : undefined,
+          userId: botUserId,
+        },
+        omit: { hash: true },
+        include: { owner: true },
+      })
+
+      span?.setAttribute('adminToken.create.tokenId', token.id)
+      this.logger.log(`adminToken.create completed (adminTokenId=${token.id}, botUserId=${botUserId}, status=${token.status})`)
+
+      return {
+        ...token,
+        password,
+        permissions: token.permissions.toString(),
+      }
+    } catch (error) {
+      this.logger.error(
+        `adminToken.create failed (tokenName=${data.name}): ${error instanceof Error ? error.message : String(error)}`,
+        error instanceof Error ? error.stack : undefined,
+      )
+      throw error
+    }
+  }
+
+  @StartActiveSpan()
+  async revoke(id: string) {
+    const span = trace.getActiveSpan()
+    span?.setAttribute('adminToken.revoke.tokenId', id)
+    this.logger.log(`adminToken.revoke started (adminTokenId=${id})`)
+
+    await this.prisma.adminToken.updateMany({
+      where: { id },
+      data: {
+        status: 'revoked',
+        expirationDate: new Date(),
+      },
+    })
+
+    this.logger.log(`adminToken.revoke completed (adminTokenId=${id})`)
+  }
+}
diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.ts
new file mode 100644
index 000000000..57e46a8c0
--- /dev/null
+++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.ts
@@ -0,0 +1,60 @@
+import type { Prisma } from '@prisma/client'
+
+export const userTokenOwnerSelect = {
+  id: true,
+  email: true,
+  firstName: true,
+  lastName: true,
+  type: true,
+} satisfies Prisma.UserSelect
+
+export const userTokenSelect = {
+  id: true,
+  name: true,
+  lastUse: true,
+  expirationDate: true,
+  status: true,
+  createdAt: true,
+  userId: true,
+  owner: {
+    select: userTokenOwnerSelect,
+  },
+} satisfies Prisma.PersonalAccessTokenSelect
+
+export type UserTokenRecord = Prisma.PersonalAccessTokenGetPayload<{
+  select: typeof userTokenSelect
+}>
+
+export function listUserTokens(db: Prisma.TransactionClient, userId: string) {
+  return db.personalAccessToken.findMany({
+    where: { userId },
+    orderBy: [{ status: 'asc' }, { createdAt: 'asc' }],
+    select: userTokenSelect,
+  })
+}
+
+export function createUserToken(db: Prisma.TransactionClient, data: {
+  name: string
+  expirationDate: string
+  hash: string
+  userId: string
+}) {
+  return db.personalAccessToken.create({
+    data: {
+      name: data.name,
+      hash: data.hash,
+      expirationDate: new Date(data.expirationDate),
+      userId: data.userId,
+    },
+    select: userTokenSelect,
+  })
+}
+
+export function getOwnedUserToken(db: Prisma.TransactionClient, tokenId: string, userId: string) {
+  return db.personalAccessToken.findUnique({
+    where: {
+      id: tokenId,
+      userId,
+    },
+  })
+}
diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens.controller.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens.controller.ts
new file mode 100644
index 000000000..2c4d07c71
--- /dev/null
+++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens.controller.ts
@@ -0,0 +1,45 @@
+import type { UserContext } from '../infrastructure/auth/auth-user.decorator'
+import { PersonalAccessTokenSchema } from '@cpn-console/shared'
+import { Body, Controller, Delete, ForbiddenException, Get, HttpCode, Inject, Param, Post, UseGuards } from '@nestjs/common'
+import { AuthUser } from '../infrastructure/auth/auth-user.decorator'
+import { UserGuard } from '../infrastructure/permission/user/user.guard'
+import { ZodValidationPipe } from '../infrastructure/pipe/zod-validation.pipe'
+import { UserTokensService } from './user-tokens.service'
+
+@Controller('api/v1/user/tokens')
+@UseGuards(UserGuard)
+export class UserTokensController {
+  constructor(@Inject(UserTokensService) private readonly service: UserTokensService) {}
+
+  @Get()
+  async list(@AuthUser() user: UserContext) {
+    if (!user.userId || user.userType !== 'human') {
+      throw new ForbiddenException('Seuls les utilisateurs humains peuvent gérer des tokens personnels')
+    }
+    return this.service.list(user.userId)
+  }
+
+  @Post()
+  @HttpCode(201)
+  async create(
+    @Body(new ZodValidationPipe(PersonalAccessTokenSchema.pick({ name: true, expirationDate: true }).required())) data: { name: string, expirationDate: string },
+    @AuthUser() user: UserContext,
+  ) {
+    if (!user.userId || user.userType !== 'human') {
+      throw new ForbiddenException('Seuls les utilisateurs humains peuvent gérer des tokens personnels')
+    }
+    return this.service.create(data, user.userId)
+  }
+
+  @Delete(':tokenId')
+  @HttpCode(204)
+  async delete(
+    @Param('tokenId') tokenId: string,
+    @AuthUser() user: UserContext,
+  ): Promise<void> {
+    if (!user.userId || user.userType !== 'human') {
+      throw new ForbiddenException('Seuls les utilisateurs humains peuvent gérer des tokens personnels')
+    }
+    return this.service.delete(tokenId, user.userId)
+  }
+}
diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens.module.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens.module.ts
new file mode 100644
index 000000000..af7a0028b
--- /dev/null
+++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens.module.ts
@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common'
+import { InfrastructureModule } from '../infrastructure/infrastructure.module'
+import { UserTokensController } from './user-tokens.controller'
+import { UserTokensService } from './user-tokens.service'
+
+@Module({
+  imports: [InfrastructureModule],
+  controllers: [UserTokensController],
+  providers: [UserTokensService],
+  exports: [UserTokensService],
+})
+export class UserTokensModule {}
diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.spec.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.spec.ts
new file mode 100644
index 000000000..45f41f1e3
--- /dev/null
+++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.spec.ts
@@ -0,0 +1,126 @@
+import type { TestingModule } from '@nestjs/testing'
+import type { DeepMockProxy } from 'vitest-mock-extended'
+import { faker } from '@faker-js/faker'
+import { Test } from '@nestjs/testing'
+import { beforeEach, describe, expect, it } from 'vitest'
+import { mockDeep } from 'vitest-mock-extended'
+import { PrismaService } from '../infrastructure/database/prisma.service'
+import { userTokenSelect } from './user-tokens-queries.utils'
+import { UserTokensService } from './user-tokens.service'
+
+describe('userTokensService', () => {
+  let module: TestingModule
+  let service: UserTokensService
+  let prisma: DeepMockProxy<PrismaService>
+
+  beforeEach(async () => {
+    prisma = mockDeep<PrismaService>()
+
+    module = await Test.createTestingModule({
+      providers: [
+        UserTokensService,
+        { provide: PrismaService, useValue: prisma },
+      ],
+    }).compile()
+
+    service = module.get(UserTokensService)
+  })
+
+  describe('list', () => {
+    it('returns user tokens ordered by status then creation date', async () => {
+      const userId = faker.string.uuid()
+      const tokenId = faker.string.uuid()
+      prisma.personalAccessToken.findMany.mockResolvedValue([{
+        id: tokenId,
+        name: 'my-token',
+        lastUse: null,
+        expirationDate: new Date(),
+        status: 'active' as const,
+        createdAt: new Date(),
+        userId,
+        hash: 'hash-1',
+      }])
+
+      const result = await service.list(userId)
+
+      expect(prisma.personalAccessToken.findMany).toHaveBeenCalledWith(
+        expect.objectContaining({ where: { userId } }),
+      )
+      expect(result).toHaveLength(1)
+      expect(result[0].id).toBe(tokenId)
+    })
+
+    it('selects only exposed token fields', async () => {
+      const userId = faker.string.uuid()
+      prisma.personalAccessToken.findMany.mockResolvedValue([])
+
+      await service.list(userId)
+
+      const callArgs = prisma.personalAccessToken.findMany.mock.calls[0]?.[0]
+      expect(callArgs?.select).toEqual(userTokenSelect)
+    })
+  })
+
+  describe('create', () => {
+    it('throws BadRequestException if expirationDate is too soon', async () => {
+      const userId = faker.string.uuid()
+      const today = new Date()
+      await expect(service.create({ name: 'x', expirationDate: today.toISOString() }, userId))
+        .rejects.toThrow('Date d\'expiration trop courte')
+      expect(prisma.personalAccessToken.create).not.toHaveBeenCalled()
+    })
+
+    it('returns created token with plaintext password', async () => {
+      const userId = faker.string.uuid()
+      const tokenId = faker.string.uuid()
+      prisma.personalAccessToken.create.mockResolvedValue({
+        id: tokenId,
+        name: 'my-token',
+        lastUse: null,
+        expirationDate: new Date(),
+        status: 'active' as const,
+        createdAt: new Date(),
+        userId,
+        hash: 'hash-2',
+      })
+
+      const result = await service.create({ name: 'my-token', expirationDate: '2099-01-01' }, userId)
+
+      expect(prisma.personalAccessToken.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            userId,
+            name: 'my-token',
+          }),
+          select: userTokenSelect,
+        }),
+      )
+      expect(result.id).toBe(tokenId)
+      expect(result.password).toBeTruthy()
+    })
+  })
+
+  describe('delete', () => {
+    it('deletes token if it exists and belongs to user', async () => {
+      const tokenId = faker.string.uuid()
+      const userId = faker.string.uuid()
+      prisma.personalAccessToken.findUnique.mockResolvedValue({ id: tokenId, userId } as never)
+      prisma.personalAccessToken.delete.mockResolvedValue({ id: tokenId } as never)
+
+      await service.delete(tokenId, userId)
+
+      expect(prisma.personalAccessToken.findUnique).toHaveBeenCalledWith({
+        where: { id: tokenId, userId },
+      })
+      expect(prisma.personalAccessToken.delete).toHaveBeenCalledWith({ where: { id: tokenId } })
+    })
+
+    it('does nothing if token not found or belongs to other user', async () => {
+      prisma.personalAccessToken.findUnique.mockResolvedValue(null)
+
+      await service.delete('unknown', 'user-1')
+
+      expect(prisma.personalAccessToken.delete).not.toHaveBeenCalled()
+    })
+  })
+})
diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.ts
new file mode 100644
index 000000000..a30c33231
--- /dev/null
+++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.ts
@@ -0,0 +1,86 @@
+import { randomBytes, scryptSync } from 'node:crypto'
+import { generateRandomPassword, isAtLeastTomorrow } from '@cpn-console/shared'
+import { BadRequestException, Inject, Injectable, Logger } from '@nestjs/common'
+import { trace } from '@opentelemetry/api'
+import { PrismaService } from '../infrastructure/database/prisma.service'
+import { StartActiveSpan } from '../infrastructure/telemetry/telemetry.decorator'
+import { createUserToken, getOwnedUserToken, listUserTokens } from './user-tokens-queries.utils'
+
+@Injectable()
+export class UserTokensService {
+  private readonly logger = new Logger(UserTokensService.name)
+
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  @StartActiveSpan()
+  async list(userId: string) {
+    const span = trace.getActiveSpan()
+    span?.setAttribute('userTokens.list.userId', userId)
+    this.logger.log(`userTokens.list requested (userId=${userId})`)
+
+    const tokens = await listUserTokens(this.prisma, userId)
+
+    span?.setAttribute('userTokens.list.count', tokens.length)
+    this.logger.log(`userTokens.list completed (userId=${userId}, count=${tokens.length})`)
+    return tokens
+  }
+
+  @StartActiveSpan()
+  async create(data: { name: string, expirationDate: string }, userId: string) {
+    const span = trace.getActiveSpan()
+    span?.setAttribute('userTokens.create.name', data.name)
+    span?.setAttribute('userTokens.create.userId', userId)
+    this.logger.log(`userTokens.create started (tokenName=${data.name}, userId=${userId})`)
+
+    if (data.expirationDate && !isAtLeastTomorrow(new Date(data.expirationDate))) {
+      this.logger.warn(`userTokens.create rejected (tokenName=${data.name}, userId=${userId}, reason=expirationTooSoon)`)
+      throw new BadRequestException('Date d\'expiration trop courte')
+    }
+
+    try {
+      const password = generateRandomPassword(48, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-')
+      const salt = randomBytes(16).toString('hex')
+      const derivedKey = scryptSync(password, salt, 64).toString('hex')
+      const hash = `${salt}:${derivedKey}`
+
+      const token = await createUserToken(this.prisma, {
+        ...data,
+        hash,
+        userId,
+      })
+
+      span?.setAttribute('userTokens.create.tokenId', token.id)
+      this.logger.log(`userTokens.create completed (tokenId=${token.id}, userId=${userId})`)
+
+      return {
+        ...token,
+        password,
+      }
+    } catch (error) {
+      this.logger.error(
+        `userTokens.create failed (tokenName=${data.name}, userId=${userId}): ${error instanceof Error ? error.message : String(error)}`,
+        error instanceof Error ? error.stack : undefined,
+      )
+      throw error
+    }
+  }
+
+  @StartActiveSpan()
+  async delete(tokenId: string, userId: string): Promise<void> {
+    const span = trace.getActiveSpan()
+    span?.setAttribute('userTokens.delete.tokenId', tokenId)
+    span?.setAttribute('userTokens.delete.userId', userId)
+    this.logger.log(`userTokens.delete started (tokenId=${tokenId}, userId=${userId})`)
+
+    const token = await getOwnedUserToken(this.prisma, tokenId, userId)
+
+    if (token) {
+      await this.prisma.personalAccessToken.delete({
+        where: { id: tokenId },
+      })
+      this.logger.log(`userTokens.delete completed (tokenId=${tokenId})`)
+    } else {
+      this.logger.log(`userTokens.delete skipped (tokenId=${tokenId}, reason=notFoundOrNotOwner)`)
+    }
+  }
+}
diff --git a/apps/server-nestjs/test/admin-token.e2e-spec.ts b/apps/server-nestjs/test/admin-token.e2e-spec.ts
new file mode 100644
index 000000000..4d6e77c5e
--- /dev/null
+++ b/apps/server-nestjs/test/admin-token.e2e-spec.ts
@@ -0,0 +1,144 @@
+import type { TestingModule } from '@nestjs/testing'
+import { faker } from '@faker-js/faker'
+import { Test } from '@nestjs/testing'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { AdminTokenModule } from '../src/modules/admin-token/admin-token.module'
+import { AdminTokenService } from '../src/modules/admin-token/admin-token.service'
+import { PrismaService } from '../src/modules/infrastructure/database/prisma.service'
+
+const canRunAdminTokenE2E = Boolean(process.env.E2E) && Boolean(process.env.DB_URL)
+
+const describeWithAdminToken = describe.runIf(canRunAdminTokenE2E)
+
+describeWithAdminToken('AdminTokenService (e2e)', () => {
+  let moduleRef: TestingModule
+  let service: AdminTokenService
+  let prisma: PrismaService
+
+  const createdTokenIds: string[] = []
+  const createdBotUserIds: string[] = []
+
+  beforeAll(async () => {
+    moduleRef = await Test.createTestingModule({
+      imports: [AdminTokenModule],
+    }).compile()
+
+    await moduleRef.init()
+
+    service = moduleRef.get(AdminTokenService)
+    prisma = moduleRef.get(PrismaService)
+  })
+
+  afterAll(async () => {
+    if (prisma) {
+      await prisma.adminToken.deleteMany({ where: { id: { in: createdTokenIds } } }).catch(() => {})
+      await prisma.user.deleteMany({ where: { id: { in: createdBotUserIds } } }).catch(() => {})
+    }
+
+    await moduleRef?.close()
+    vi.restoreAllMocks()
+    vi.unstubAllEnvs()
+  })
+
+  it('should create a bot user and issue a token with plaintext password', async () => {
+    const result = await service.create({
+      name: `e2e-admin-${faker.string.uuid()}`,
+      permissions: String(1n << 16n),
+      expirationDate: null,
+    })
+
+    expect(result.id).toBeTruthy()
+    expect(result.password).toBeTruthy()
+    expect(result.password.length).toBe(48)
+    expect(result.name).toMatch(/^e2e-admin-/)
+    expect(result.status).toBe('active')
+    expect(result.permissions).toBe(String(1n << 16n))
+
+    createdTokenIds.push(result.id)
+    if (result.owner?.id) {
+      createdBotUserIds.push(result.owner.id)
+    }
+  })
+
+  it('should list active tokens by default and include revoked when requested', async () => {
+    const tokenName = `e2e-admin-${faker.string.uuid()}`
+    const created = await service.create({
+      name: tokenName,
+      permissions: String(1n << 16n),
+      expirationDate: null,
+    })
+    createdTokenIds.push(created.id)
+    if (created.owner?.id) createdBotUserIds.push(created.owner.id)
+
+    const activeOnly = await service.list(false)
+    expect(activeOnly.some(t => t.id === created.id)).toBe(true)
+    expect(activeOnly.every(t => t.status === 'active')).toBe(true)
+
+    const withRevoked = await service.list(true)
+    expect(withRevoked.length).toBeGreaterThanOrEqual(activeOnly.length)
+  })
+
+  it('should revoke a token and exclude it from active list', async () => {
+    const created = await service.create({
+      name: `e2e-revoke-${faker.string.uuid()}`,
+      permissions: String(1n << 16n),
+      expirationDate: null,
+    })
+    createdTokenIds.push(created.id)
+    if (created.owner?.id) createdBotUserIds.push(created.owner.id)
+
+    await service.revoke(created.id)
+
+    const activeOnly = await service.list(false)
+    expect(activeOnly.some(t => t.id === created.id)).toBe(false)
+
+    const withRevoked = await service.list(true)
+    const revokedToken = withRevoked.find(t => t.id === created.id)
+    expect(revokedToken).toBeTruthy()
+    expect(revokedToken?.status).toBe('revoked')
+  })
+
+  it('should reject creation with expiration date in the past', async () => {
+    const yesterday = new Date(Date.now() - 86400000).toISOString()
+    await expect(service.create({
+      name: `e2e-expired-${faker.string.uuid()}`,
+      permissions: '0',
+      expirationDate: yesterday,
+    })).rejects.toThrow('Date d\'expiration trop courte')
+  })
+
+  it('should persist a salted scrypt hash of the password in DB', async () => {
+    const created = await service.create({
+      name: `e2e-hash-${faker.string.uuid()}`,
+      permissions: String(1n << 16n),
+      expirationDate: null,
+    })
+    createdTokenIds.push(created.id)
+    if (created.owner?.id) createdBotUserIds.push(created.owner.id)
+
+    const stored = await prisma.adminToken.findUniqueOrThrow({
+      where: { id: created.id },
+      select: { hash: true },
+    })
+
+    expect(stored.hash).toMatch(/^scrypt\$[0-9a-f]+\$[0-9a-f]+$/)
+    expect(stored.hash).not.toContain(created.password)
+  })
+
+  it('should omit hash from API responses', async () => {
+    const created = await service.create({
+      name: `e2e-omit-${faker.string.uuid()}`,
+      permissions: String(1n << 16n),
+      expirationDate: null,
+    })
+    createdTokenIds.push(created.id)
+    if (created.owner?.id) createdBotUserIds.push(created.owner.id)
+
+    expect(created).not.toHaveProperty('hash')
+
+    const listed = await service.list(true)
+    const found = listed.find(t => t.id === created.id)
+    expect(found).toBeTruthy()
+    expect(found).not.toHaveProperty('hash')
+  })
+})
diff --git a/apps/server-nestjs/test/user-tokens.e2e-spec.ts b/apps/server-nestjs/test/user-tokens.e2e-spec.ts
new file mode 100644
index 000000000..1f9c6d7d2
--- /dev/null
+++ b/apps/server-nestjs/test/user-tokens.e2e-spec.ts
@@ -0,0 +1,175 @@
+import type { TestingModule } from '@nestjs/testing'
+import { createHash } from 'node:crypto'
+import { faker } from '@faker-js/faker'
+import { Test } from '@nestjs/testing'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { PrismaService } from '../src/modules/infrastructure/database/prisma.service'
+import { UserTokensModule } from '../src/modules/user-tokens/user-tokens.module'
+import { UserTokensService } from '../src/modules/user-tokens/user-tokens.service'
+
+const canRunUserTokensE2E = Boolean(process.env.E2E) && Boolean(process.env.DB_URL)
+
+const describeWithUserTokens = describe.runIf(canRunUserTokensE2E)
+
+describeWithUserTokens('UserTokensService (e2e)', () => {
+  let moduleRef: TestingModule
+  let service: UserTokensService
+  let prisma: PrismaService
+
+  const createdTokenIds: string[] = []
+  const createdUserIds: string[] = []
+  let ownerId: string
+  let otherUserId: string
+
+  beforeAll(async () => {
+    moduleRef = await Test.createTestingModule({
+      imports: [UserTokensModule],
+    }).compile()
+
+    await moduleRef.init()
+
+    service = moduleRef.get(UserTokensService)
+    prisma = moduleRef.get(PrismaService)
+
+    ownerId = faker.string.uuid()
+    otherUserId = faker.string.uuid()
+
+    await prisma.user.create({
+      data: {
+        id: ownerId,
+        email: faker.internet.email().toLowerCase(),
+        firstName: faker.person.firstName(),
+        lastName: faker.person.lastName(),
+        type: 'human',
+        adminRoleIds: [],
+      },
+    })
+    createdUserIds.push(ownerId)
+
+    await prisma.user.create({
+      data: {
+        id: otherUserId,
+        email: faker.internet.email().toLowerCase(),
+        firstName: faker.person.firstName(),
+        lastName: faker.person.lastName(),
+        type: 'human',
+        adminRoleIds: [],
+      },
+    })
+    createdUserIds.push(otherUserId)
+  })
+
+  afterAll(async () => {
+    if (prisma) {
+      await prisma.personalAccessToken.deleteMany({ where: { id: { in: createdTokenIds } } }).catch(() => {})
+      await prisma.user.deleteMany({ where: { id: { in: createdUserIds } } }).catch(() => {})
+    }
+
+    await moduleRef?.close()
+    vi.restoreAllMocks()
+    vi.unstubAllEnvs()
+  })
+
+  it('should create a personal access token with plaintext password', async () => {
+    const result = await service.create({
+      name: `e2e-pat-${faker.string.uuid()}`,
+      expirationDate: new Date(Date.now() + 86400000).toISOString(),
+    }, ownerId)
+
+    expect(result.id).toBeTruthy()
+    expect(result.password).toBeTruthy()
+    expect(result.password.length).toBe(48)
+    expect(result.name).toMatch(/^e2e-pat-/)
+    expect(result.expirationDate).toBeTruthy()
+
+    createdTokenIds.push(result.id)
+  })
+
+  it('should list only tokens for the requesting user', async () => {
+    const tokenName = `e2e-pat-list-${faker.string.uuid()}`
+    const created = await service.create({
+      name: tokenName,
+      expirationDate: new Date(Date.now() + 86400000).toISOString(),
+    }, ownerId)
+    createdTokenIds.push(created.id)
+
+    const otherTokenName = `e2e-pat-other-${faker.string.uuid()}`
+    const otherToken = await service.create({
+      name: otherTokenName,
+      expirationDate: new Date(Date.now() + 86400000).toISOString(),
+    }, otherUserId)
+    createdTokenIds.push(otherToken.id)
+
+    const userTokens = await service.list(ownerId)
+    expect(userTokens.some(t => t.id === created.id)).toBe(true)
+    expect(userTokens.some(t => t.id === otherToken.id)).toBe(false)
+  })
+
+  it('should hard-delete token and remove it from list', async () => {
+    const created = await service.create({
+      name: `e2e-pat-delete-${faker.string.uuid()}`,
+      expirationDate: new Date(Date.now() + 86400000).toISOString(),
+    }, ownerId)
+    createdTokenIds.push(created.id)
+
+    await service.delete(created.id, ownerId)
+
+    const userTokens = await service.list(ownerId)
+    expect(userTokens.some(t => t.id === created.id)).toBe(false)
+
+    const stored = await prisma.personalAccessToken.findUnique({ where: { id: created.id } })
+    expect(stored).toBeNull()
+  })
+
+  it('should not delete another user\'s token', async () => {
+    const otherToken = await service.create({
+      name: `e2e-pat-foreign-${faker.string.uuid()}`,
+      expirationDate: new Date(Date.now() + 86400000).toISOString(),
+    }, otherUserId)
+    createdTokenIds.push(otherToken.id)
+
+    await service.delete(otherToken.id, ownerId)
+
+    const stored = await prisma.personalAccessToken.findUnique({ where: { id: otherToken.id } })
+    expect(stored).not.toBeNull()
+  })
+
+  it('should reject creation with expiration date in the past', async () => {
+    const yesterday = new Date(Date.now() - 86400000).toISOString()
+    await expect(service.create({
+      name: `e2e-pat-expired-${faker.string.uuid()}`,
+      expirationDate: yesterday,
+    }, ownerId)).rejects.toThrow('Date d\'expiration trop courte')
+  })
+
+  it('should persist SHA256 hash of the password in DB', async () => {
+    const created = await service.create({
+      name: `e2e-pat-hash-${faker.string.uuid()}`,
+      expirationDate: new Date(Date.now() + 86400000).toISOString(),
+    }, ownerId)
+    createdTokenIds.push(created.id)
+
+    const stored = await prisma.personalAccessToken.findUniqueOrThrow({
+      where: { id: created.id },
+      select: { hash: true },
+    })
+
+    const expectedHash = createHash('sha256').update(created.password).digest('hex')
+    expect(stored.hash).toBe(expectedHash)
+  })
+
+  it('should omit hash from API responses', async () => {
+    const created = await service.create({
+      name: `e2e-pat-omit-${faker.string.uuid()}`,
+      expirationDate: new Date(Date.now() + 86400000).toISOString(),
+    }, ownerId)
+    createdTokenIds.push(created.id)
+
+    expect(created).not.toHaveProperty('hash')
+
+    const listed = await service.list(ownerId)
+    const found = listed.find(t => t.id === created.id)
+    expect(found).toBeTruthy()
+    expect(found).not.toHaveProperty('hash')
+  })
+})