0

We want users of our service to be able to write programs/scripts that act on their (i.e. the user's) behalf.

I've seen various services (github, digital ocean, gitlab) use Personal Access Tokens (PATs) for that purpose.

Is this not something OAuth can help with, specifically Client Credentials?

In our case, we use short-lived and stateless JWTs as access tokens for our API. So, if we were to implement something similar to PATs, it would end up looking a lot like Client Credentials anyway. i.e.:

  • user (in their script) requests said long-lived credential, and they get an (id, secret) pair
  • user (in their script) uses (id, secret) to request Access Token (short-lived)
  • user (in their script) make the desired API request with the Access Token
  • user (in their script) uses (id, secret) to request new Access Token if existing one expired

The sub claim in the JWT access token is the user id, which is why I'm hesitating to call this flow Client Credentials.

6
  • 1
    If I'm not mistaken PATs are closer to API keys. I.e. you use them as-is, you do not use them to obtain a separate token to access the APIs.
    – GACy20
    Commented Nov 29, 2022 at 9:51
  • yes, that's correct. But we can't do that, because we protect our APIs via stateless and short-lived jwts.
    – Sam
    Commented Nov 29, 2022 at 10:12
  • so we can't give users an api Access Token that'll be usable for, say, 10 years or forever. If we did, then we'd have to keep track of which access tokens have been revoked forever.
    – Sam
    Commented Nov 29, 2022 at 10:20
  • What's the question?
    – defalt
    Commented Nov 29, 2022 at 13:06
  • is my problem something OAuth is meant to help with? (user writing automations for their accounts)
    – Sam
    Commented Nov 29, 2022 at 14:31

0

You must log in to answer this question.

Browse other questions tagged .