Wouldn't it be much simpler and virtually equally secure to replace tokens by pure client credentials? Client credentials wouldn't expire and resource owners would always be able to modify their ...
I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create ...