Can a token have multiple audiences?
The second option—single access token, with multiple audiences covering all desired APIs—is allowed by the spec, but multi-audience JWTs acting as OAuth 2 access tokens isn’t universally supported by IdP vendors, API gateway vendors or other libraries.
How can I reuse OAuth token?
Yes, the token is supposed to be used as many times as you need within the given expiry time (google sets it to 1 hour). After it has expired, use the refresh token to get another access token and use it as many times as you need. Keep repeating the process.
When to use multi-audience token in OAuth?
In a situation where token delegation is being used (i.e., the API gateway obtains a new access token that describes the authenticated user, but has a different audience, scope and claim information describing the downstream API Provider), the multi-audience token may provide significant simplification of the mechanics needed to obtain new tokens.
What’s the difference between OAuth2 and JWT audiences?
OAuth2 says nothing about audiences; but Jwt says a lot. Jwt says that the token can have multiple – or one – audiences; it also says that the recipients of the tokens should validate that they are included in the audiences and reject the token if they are not.
Are there any OAuth 2.0 mutual TLS tokens?
Sender-Constrained Access Tokens via “ OAuth 2.0 Token Binding ”, “ OAuth 2.0 Mutual TLS ”, “ OAuth 2.0 Signed HTTP Requests ” or “ JWT Pop Tokens. ” None of these is widely deployed, and we’ll save exploring them for a future post.
Which is client side authentication library does OAuth2 use?
Ideally, an (OAuth2) client-side authentication library would be used that implements this token caching rather than the developer implementing their own caching layer. Depending on the token usage strategy, the requirements for token caching will vary.