Refresh Token
Using OAuth, at what Point do you refresh an Access Token? Let's say your User have an API Access Key that is valid for 1h, the Refresh Keys are endless valid. At what Point do you insert a refresh Function?
Every time the user makes a Request where a valid access Key is needed? Check if key is valid and request a new one if not valid (API response = 401)? Automatically refresh all keys with a scheduler/event Listener?
Hi there,
This is a good question. Not 100% what is considered a best practice here, but I would probably personally check for a 401 response, that way I would reduce the total amount of requests to the auth API for generating a new call.
Usually there might be a limit on how many refresh tokens you could get in a certain period, so if you get a new token on every single request that is not going to be very insufficient.
Also on the OAuth backend, the generation of a new token is probably a totally separate service.
Here is a good diagram on how this works in practice:
