4 ms·
Oauth2 tokens or jwt.
by spdionis 9y ago
Oauth2 tokens or jwt.
- MaxBarraclough 9y agoSeems to me the answer is indeed that simple: use OAuth2 and be done.
- sidhuko 9y agoSo you need to get an access token by validating against a third-party (keycloak, auth0) to access your own API? That's a pain.
- MaxBarraclough 9y agoThird-party? Token-issuance is just another endpoint, no?
- spdionis 9y agoJust use a regular oauth server library in your language/framework of choice.
- davewritescode 9y agoOAuth 2.0 is so bloated that it scares people off. Something like the client credentials flow is relatively easy to implement on your own and is basically lets clients exchange a client_id (username) and secret (password) for an API key. Bonus: If you stay close enough to the standard you can plugin a real OAuth 2.0 provider if/when you decide you need it.
- MaxBarraclough 9y ago> OAuth 2.0 is so bloated that it scares people off I think we're thinking the same thought, maybe my terminology is sloppy. Suppose we just say "Use this token-generation endpoint (with your credentials) to generate a session token, and attach that token by means of OAuth 2.0 Bearer Token in subsequent requests to other endpoints". Doing that, we can easily scythe off any bloat, no? We don't care about people signing-in with their Google accounts, or anything like that. Or is that what 'client credentials flow' means?