OAuth 2: A closer look
summary
A CRM marketplace uses OAuth 2 for third‑party apps, issuing client_id/secret, one‑hour access tokens and refresh tokens; early implementation reissued refresh tokens on every refresh and sees widespread failed requests, so policy shifts to long‑lived refresh tokens (Spotify‑style) to reduce breakage. A custom endpoint to convert API tokens into app installs migrates legacy integrations. Demonstrates flows with Postman, explains CSRF risk and shows the state parameter as the practical fix by binding the auth code to the user session.
AI-written summary · about
chapters (7)
- 0:00Introduction and thanks
- 1:48What is OAuth 2
- 3:57API keys vs OAuth 2
- 5:23OAuth 2 flow explained
- 10:22Refresh tokens best practices
- 13:02State parameter and CSRF
- 17:43Q&A session
