4 ms·
https://stripe.com/docs/api/authentication https://stripe.com/docs/api/authentication Even pure server-to-server applications with "no user involved" are start
by pbreit 5y ago
https://stripe.com/docs/api/authentication https://stripe.com/docs/api/authentication
Even pure server-to-server applications with "no user involved" are starting to use OAuth authentication which I don't quite understand.
https://www.verygoodsecurity.com/docs/payment-optimization/authentication https://www.verygoodsecurity.com/docs/payment-optimization/a...
- DrBenCarson 5y agothe `client_credentials` grant is literally made for server-to-server applications
- pbreit 5y agoBut why bother with the extra call to request an access token? Makes everything harder for modest security gains.
- loginatnine 5y agoAccess tokens are short lived and can easily be revoked (when opaque). Sending your service credentials to every service is arguably less secure since they can have lesser security or log unwanted things.
- pbreit 5y agoRevocation is actually a major problem with JWTs.