You can then refresh the token at a regular interval. One approach is to store a token in the filesystem, a cache, or the application's configuration. We recommend the following approaches when working with short-lived client applications to reduce the number of tokens requested. For example, a script triggered by a cron job which creates a client every time the job runs, or a function in a serverless Function-as-a-Service environment. In some scenarios, your SDK clients are short-lived. If the introspection takes 200 ms to return a result, the whole API call takes 200 ms longer. If the token introspection fails, the whole API call fails. Please note that using External OAuth tokens affects performance.
The API may cache External OAuth tokens until the token expires (given by the exp field in the introspection response ) for a maximum of an hour. The APIs validate the tokens against the respective introspection endpoints with no additional configuration required. In other cases, you may have to implement a service specifically to verify the token or create the scope.Ī Project using tokens issued by an external OAuth service can continue to use tokens issued by Composable Commerce. Some services, especially OpenID Connect implementations, may already provide such an endpoint and may allow embedding permissions specific to Composable Commerce into the scope. Any scopes which are not listed in the Scopes section are ignored. The Composable Commerce Authorization API calls the endpoint provided to verify the validity of the token, and check the token's scopes.
To use OAuth 2.0 Bearer tokens issued by another service, provide an RFC 7662-compliant OAuth 2.0 Token Introspection endpoint to your Project using the Set ExternalOAuth update action. If you are familiar with Postman, you can also use commercetools Postman Collections to create code snippets for authenticating to the API.
0 kommentar(er)
