Analizar OAuth 2.0 token responses
OAuth 2.0 returns access_token, token_type, expires_in, y optionally refresh_token. Aprender a analizar y usar el token respuesta correctly.
- 1
An OAuth 2.0 token response is a JSON object: {access_token, token_type: "Bearer", expires_in: 3600, refresh_token, scope}. The access_token is used in the Authorization header. The refresh_token obtains a new access_token when it expires. Store the refresh_token securely (HttpOnly cookie) — it has a longer lifetime and greater access.
- 2 Decodificador de JWT →
Decodificar the access_token if it is a JWT. Inspect the claims (sub, exp, scope, iss, aud) to understand the token's permissions and expiration. If it is an opaque token, call the introspection endpoint to get the token info.
- 3 Formateador JSON →
Formatear the token response JSON to inspect all fields. Verify: token_type is "Bearer", expires_in is reasonable (3600 = 1 hour), scope matches what you requested. Store the expiration timestamp to proactively refresh before expiry.
Preguntas frecuentes
- What is a refresh token?
- A refresh token is a credential used to obtain a new access token when the current one expires. It has a longer lifetime (days to weeks) and is stored securely (HttpOnly cookie, secure storage). The access token is short-lived (minutes to hours) and sent to APIs. This limits the exposure window if an access token is stolen.
- What is the token_type field?
- It indicates how to use the token. "Bearer" means put it in the Authorization header: "Authorization: Bearer <token>". This is the only widely supported type. Other types (MAC, POP) were proposed but not adopted. Always check token_type and use the correct mechanism.