Token base auth : best flow to handle refresh token

Ask us anything Tips and Hacks
1

Hello,

I use Token based auth plugin, I can log in and store :

  • access token
  • refresh token
  • user data

I need to access REST API endpoints with an authorization bearer token that can expire, what is the best way to handle the refresh token in this case ?

Thanks
Vincent

2

I achieved this by doing so :

Firstly, add a global workflow that will store accessToken_expiresAt and that take a parameter named expires. In my case I had to do :
return Date.now()+context.parameters['expires']. Run this workflow from the Login workflow.

Secondly, add an other global workflow that will :

  1. check if access_token is expired
let expiresAtMs = variables['c42d108a-ed4f-4195-839c-3ba82c8780f6']
return expiresAtMs < Date.now()
  1. if expired, renew it by calling POST /auth/refresh,
  2. store the new access_token and refresh_token,
  3. call the other global workflow that will update accessToken_expiresAt.

If any of this fails : log out the user and go to log in page, that would mean that the refresh_token has also expired and user needs to log in again.

Now in my local workflow that needs to fetch protected data, I just add the second global workflow as the first operation.

Any better idea ?

3

Drawback : this workaround does not work on REST API collections

4

Hello !
I’m a beginner with API and I’m wondering as well how to handle refresh token for REST API collections.
Did you manage to make it work @vwasteels ?

5

What I did is to set a collection with “Fetch this collection automatically” disabled , then add a page workflow where I need the data that will first check the token by running the global workflow described above.