i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created.
we have three actors (the client [the app that wants to connect to the API], the Connect API (the api server), and the user).
that API works as follows: (Using OAUTH1.0)
1- the client have a consumer key and secret, first he signs the request and sends the consumer secret to the api.
2- the api server responds to the request by unauthorized Request token and secret.
3- the client sends again to the api server a request signed by the request token.
4- the api server let the user sign in and select whether to agree on the connection or not, when agreed, the api server sends a verification token to the callback url, specified by the client.
5- the client sends back to the api server the verification token.
6- the api server sends back the access key and secret, which the client will store them for the user (per user).
7- afterwards, the api server will send the files (push) to the client push url, as a multipart request along with the access secret.
and like that the client knows who is the user that the file belongs to.
i want to implement something similar to this, with a push api, but i would like to use oauth2 instead of oauth1. the problem i have mainly is in the long lasting access token that is provided in the last step, and with no signing or authenticating, i cant use a refresh token mechanism as well.
how can i do it, does there is any thoughts about it??