Contents
How long does an access token last?
The access tokens may last anywhere from the current application session to a couple weeks. When the access token expires, the application will be forced to make the user sign in again, so that you as the service know the user is continually involved in re-authorizing the application.
What is an OAuth 2 access token?
The access token represents the authorization of a specific application to access specific parts of a user’s data. Access tokens must be kept confidential in transit and in storage. The only parties that should ever see the access token are the application itself, the authorization server, and resource server.
How can I get OAuth 2 access token?
- Obtain OAuth 2.0 credentials from the Google API Console.
- Obtain an access token from the Google Authorization Server.
- Examine scopes of access granted by the user.
- Send the access token to an API.
- Refresh the access token, if necessary.
How are access tokens used in OAuth 2.0?
A common method of granting tokens is to use a combination of access tokens and refresh tokens for maximum security and flexibility. The OAuth 2.0 spec recommends this option, and several of the larger implementations have gone with this approach.
When to use OAuth 2.0 password grant type?
OAuth 2.0 Password Grant. The Password grant type is a way to exchange a user’s credentials for an access token. Because the client application has to collect the user’s password and send it to the authorization server, it is not recommended that this grant be used at all anymore.
When to use short-lived access tokens with no refresh?
In summary, use short-lived access tokens with no refresh tokens when: you want to the most protection against the risk of leaked access tokens you want to force users to be aware of third-party access they are granting Non-expiring access tokens are the easiest method for developers.
What happens when an access token is issued?
When the service issues the access token, it also generates a refresh token that never expires and returns that in the response as well. (Note that refresh tokens can’t be issued using the Implicit grant.)