Hello,
We have created on our edge OAuth2 access token generation API.
High level description:
- Retrieve the Access Token from Authorization Server (The edge)
- Use the Bearer Token to access the API Resource
I can see a pattern. Most of the internal business unit using our APIs do not implement a best practice. i.e. our "token_generater" API base on the credential is always called no matter if the token is still valid or not. That generate exponential calls to the particularly API. note: we have a 15m token expire.
Furthermore, we often have the question "Why we ca not have a long lasting either never expire token for internal business unit that we trust?"
We trying to educate the consumer to implement the code in a way, that you only make the call if the token is not valid... But that is not working for the last years...
What is the recommendation on this case?
Should we have never expire token for trust internal consumers meaning expires only if the dev_app expires or token is revoked?
Br,
João Paulo
LinkedIn
Twitter
