5 ms·
Just a brief addition to this as a user of APIs. Allow me to create a new token and have two tokens for the same account. This makes rotation of tokens without
by colinhowe 9y ago
Just a brief addition to this as a user of APIs. Allow me to create a new token and have two tokens for the same account. This makes rotation of tokens without loss of service possible :)
- tptacek 9y agoThe downside to allowing multiple tokens is that in the real world, people will create new tokens for new deployment environments, but never delete the old ones, which will inevitably end up on Github somehow.
- jdc0589 9y agoagreed, but its a solvable problem. e.g. You can request a second token, but doing so immediately sets the currently active token to expire and be deleted in X days.
- tptacek 9y agoSorry, I made it sound like I think multiple tokens is an illegitimate choice. It's not; I just think, be aware of the tradeoffs and keep things as simple as they can possibly be.