4 ms·
Why not tokens? They're easy and work well with an Authorization header on mobile.
by lilbobbytables 9y ago
Why not tokens? They're easy and work well with an Authorization header on mobile.
- coldacid 9y agoI'd argue that they can also be implemented in a much more lightweight fashion than having to go through a whole OAuth flow just for a mobile app that hits an API that you control completely.
- tytytytytytytyt 9y agoThen you have to deal with password resets and account creation, which if you know how those work, don't really sound all that lightweight compared to OAuth 2.
- kevlened 9y agoI'm not sure what you mean. The OAuth2 spec defines access tokens and also specifies that they should go in an Authorization header.