Consider allowing lifetime tokens

Created on 9 February 2020, about 5 years ago
Updated 26 February 2025, about 1 month ago

Occasionally, there's the need of having lifetime tokens, in case that the client doesn't log in themselves, machine to machine, or just for testing, from https://www.oauth.com/oauth2-servers/access-tokens/access-token-lifetime:

Non-expiring access tokens are much easier for developers testing their own applications. You can even pre-generate one or more non-expiring access tokens for developers and show it to them on the application details screen. This way they can immediately start making API requests with the token, and not worry about setting up an OAuth flow in order to start testing your API.

Ideally this should pair very well on being able to override expiration date on the consumer entity, maybe on some delegation of control way, instead of embedding it in the consumers module, which I'm aware is not an option.

Adding two possibly related issues in the same area.

Related conversation on the phpleague/oauth2-server queue: https://github.com/thephpleague/oauth2-server/issues/946

Feature request
Status

Closed: outdated

Version

5.0

Component

Code

Created by

🇪🇸Spain pcambra Asturies

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024