I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring).

I had a look at Kong and other oauth2 implementations but i get the feeling that this might be overpowered.

So i think a token-based RBA authentication should be fine for the beginning. The problem is, that this approach relies on expiration dates for tokens. But as i said - this is not what i want. So is it ok to have non-expiring tokens?

Also - what do you think? Is Oauth2 essential for my usecase? And how difficult would it be to later on migrate from a simple security concept (RBAC with access tokens) to Oauth2?


I'll begin by answering with two other questions :

  • If you roll your own solution, how much time will it take you ?
  • If your API is public by design, how fast can your developer understand a non-standard authorization mechanism ?

OAuth 2.0 has the benefit of being pretty popular so you can expect your clients (developers) to already know it. You don't need to document all the gore details, you can just point beginners to the specs and existing tutorials.

Also if you're using Java, deploying your own authorization server with Spring Security + Spring Boot or Spring Cloud will be a matter of days, even if you start from scratch. Securing your resource servers (HTTP API) with Spring Security is also made easy.

From a very pragmatic standpoint, OAuth 2.0 is less overkill than building your own solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.