Posted by Peter Jacobsen, Technical Writer
OAuth 2.0 is an open standard authorization framework for token-based authorization on the internet. An OAuth 2.0 access token is a string that the OAuth 2.0 client uses to make requests to the resource server, and hides the user's identity or other information from the OAuth 2.0 client. Only use access tokens to make requests to the resource server.
Access tokens periodically expire and become invalid credentials for a related API request. If you requested offline access to the scopes associated with the token, you can refresh an access token without prompting the user for permission, even when the user isn't present.
As a best practice, set the expiration time for refresh tokens for a little longer than the access tokens. For example, if you set the expiration to 30 minutes for an access token, set the refresh token's expiration to 24 hours or longer.
For more information, see Refreshing an access token (offline access).
Some apps may request that the user reauthenticate after a shorter period of time, which relies on the access token alone rather than a refresh token. These apps have online access as opposed to those that have a refresh token and are considered to have offline access.
For more information, see Refreshing an access token (offline access) and Refresh tokens.
To authenticate to Cloud IoT, each device must prepare a JWT. JWTs are used for short-lived authentication between devices and the MQTT or HTTP bridges.
JWTs are composed of three sections: a header, a payload that contains a claim set, and a signature. The header and payload are JSON objects that are serialized to UTF-8 bytes and then encoded with Base64 URL encoding.
The JWT's header, payload, and signature are concatenated with periods. As a result, a JWT typically takes this form:
{Base64url encoded header}.{Base64url encoded
payload}.{Base64url encoded signature}
For more information, see Using JSON Web Tokens (JWTs) and Managing JWT token expiration.
There are different policies and strategies that you can use to manage token expiration. You can: