after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd party API access token?).

Let's say I have my resource server (my-api.com), my identity provider and authorization server (my-idp.com) and have an client app (native or browser) (com.my-app).

The standard use-case is implemented with the authorization grant flow.

I now have a new use-case, where I need to request data from a 3rd party resource server (other-api.com). The 3rd party has an identity provider as well and offers OAuth 2.0 authorization and OpenID authentication flows. Resource owners of the 3rd party need to give their consent to my application so I can request their data and further use it in my application.

My questions are the following:

Is the on-behalf-flow what I need? It seems to be for two APIs which I control, not for 3rd party APIs.

How do I handle the 3rd party access, refresh and id token to make requests on-behalf of the resource owner?

  1. I could store the 3rd party tokens in my-api.com and append it to every request I do to request data for my user?
  2. I could store the 3rd party tokens in my-idp.com next to my user information?
  3. I could send the 3rd party tokens to com.my-app which would result in two tokens for each party. This seems to be awkward.

I would go for option 2 and would extend the functionality of my-idp.com. Is this a valid approach? My API my-api.com would then fetch the 3rd party tokens before it does requests on-behalf of my user.


| improve this question | | | | |

It's actually depends on what you need such token for.

  • If you are going to use token internally-only, it's number 1.

  • If you're going to provide the user way to do some third party activities from your client app (allow user to share content of the app via Facebook post) -- then it's number 3.

  • And if you need both -- it's number 2, with caching on 1 and 3.

| improve this answer | | | | |
  • Thanks! Is there any RFC or similar? – johannespartin Mar 18 at 15:14
  • No, as far as i know. Most of these comes from experience through trial and error :) – Dmitry Arkhipenko Mar 19 at 19:05

You're going to need to go through the authorization grant flow again with the 3rd party resource and identity provider in the same way you did with your initial resource and idp.

| improve this answer | | | | |
  • Thanks for your answer. But where do I store the 3rd party token? – johannespartin Mar 16 at 15:08
  • Usually it's session storage – akdombrowski Apr 15 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.