Sky API headless oAutho2

Amit Mandal
Amit Mandal
Third Anniversary
in Merchant Services APIs
We are trying to create a headless app to call payment sky API, to process payments. We came across the issue, that to get the authorization token we always need to go by oAutho2 pop up. But we can not allow the end user. End users will not have that information.

As an alternative, suggested in developer forum, we are first getting the refresh token using postman and then using this refresh token, to get authorization token. But the question is how long this refresh token will be alive, if we use preserve refresh token parameter? Is that the initial refresh token, that we obtained from postman, can be made alive for lifetime, and no manual intervention is needed to obtain a refresh token, further, when we put the code in production?

Please let us know, if there is any other way to achieve that?

Our strong requirement is this refresh token must never expire (Now it is expiring after one hour).

Comments

  • Steven Cinquegrana
    Steven Cinquegrana
    Ninth Anniversary Kudos 2 Name Dropper Participant

    Hi @Amit Mandal.

    The other posts you would have hopefully read should cover your questions, but in brief:

    1. The Refresh Token currently has a life of 365 days; it's the Access Token that expires after an hour.
    2. The default behaviour is for the Refresh Token to be renewed when a new Access Token is requested, but it can be set to persist using the preserve_refresh_token option.
    3. No matter what, you will eventually have to refresh the Refresh Token, but this can be managed in your code.
    4. Unfortunately, the gotcha with oAuth2 is that if anything goes wrong in the token exchange - a network or server outage, etc - you face the prospect of having to manually re-establish your token set. You would need to set up some kind of alert or monitoring system to handle this. It's one of the biggest annoyances of oAuth over more manageable authorisation methods - especially for headless/unattended applications - such as HTTP Basic Auth. You can hunt around the web and the Community for commentary on this subject.


    I hope that helps.

    Cheers,

    Steve Cinquegrana | CEO and Principal Developer | Protégé Solutions

Categories