I have an app that relies on several OAuth2 providers to poll for background data on behalf of users, as a background process. As a matter of best-practice, I'd like to periodically cycle my client secrets.

The OAuth2 providers I'm using (and every OAuth2 provider I've ever seen) will allow me to re-generate a key/secret pair, but will not allow me to create a second pair. If I re-generate my secret, there will necessarily be downtime, because the existing key will be invalidated and the app won't know about the new secret yet.

I can't work around this by creating a new OAuth2 relationship, because I would lose all of my permissions to poll data on behalf of my existing users.

How can an application cycle OAuth2 keys without downtime?

  • Doesn't the app automatically refresh the short-term token using its long-term secret when it gets an authentication error? – CodesInChaos Oct 16 '16 at 11:08
  • @CodesInChaos I think you're talking about the access/refresh token pair - the access token is short-lived, and is replaced on expiry. The refresh token is what permits that replacement. Both of those are specific to each user, though - as an OAuth2 consumer, I have a secret key that I use to authenticate my whole app. If my secret is invalidated (by, for example, cycling out keys), then none of my refresh tokens are any good. – Mark Tabler Nov 23 '16 at 22:54

This is something I've been wondering about as well. I don't think a solution exists right now, but I believe new systems can be designed to do this without downtime by leveraging Trust Assertions for Certificate Keys (TACK) to do so.

When the client decides to cycle to a new secret we need a mechanism to ensure the server can trust the new secret. In other words, the new secret needs to be signed (i.e. a TACK) by the client. That's what the TACK specification covers, and details a lifecycle for creating a new TACK, revoking, etc. - most importantly it covers the handling of overlapping TACKs so you don't have downtime.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.