Enterprise API Management

API bearer of obscure token

Problem statement:

This pattern has similar requirements to the bearer of token, with the difference being that in this case, a consuming application can't ever be trusted and thus will never be exposed to the user credentials or any details of the user that may be available in the token.

Solution:

A solution is to implement the OAuth 2.0 authorization code grant, but extend it with the use of obscure tokens so the consuming application never gets exposed to any details of the token. The way this works is that instead of the authorization server issuing a standard JWT, once the consuming application obtains the authorization code, the server will issue an obscured token, for example, a random string, that has no ...