Geek Answers Handbook

Best practice for updating OAuth token

I am implementing OAuth for a project and I want to know how best to handle update tokens.

The API that I call will return a JSON object with access_token, expires_in and refresh_token. So I was wondering if it is better:

  • Calculate the expiration time of access_token and save it in the database. Make sure the access_token has not expired with every API call, and if it has expired, use refresh_token to get a new access_token.

    (An additional question is: how can I make sure that the time I calculate for the token expiration is more accurate? Since the expire_in value probably starts from the moment the API server generated the key, and not when I get it.)

OR

  1. Just try calling the API call with access_token each time, and if that happens with an error, use refresh_token.

I am also open to other options for implementing this.

+4
source share
2 answers

The client should always be prepared to handle the error returned from the API, which indicates that the verification access_tokenfailed. Depending on the implementation, the access token may be revoked or invalidated otherwise.

refresh_token . , 1., 2. , 2 .

, , 1. .

+2

More articles:


All Articles