We use the implicit grant flow to log into the session and from there on it works fine at first. The user can use the app and the app uses the API to answer or end calls. But after using the app for a certain period of time (a few hours) it receives a 401 Unauthorized when making a call:
The only way we can reproduce this is to let the OAuth token duration expire. However the customer has set this to 24 hours and they log in and off every day.
What could cause this behaviour?
Is there a system log related to OAuth events we can check to see what is happening?
If an application gets a 401 response, it's one of two causes:
The application didn't provide authorization with the request
The authorization sent with the request was invalid.
The solution to both cases is that the application should handle the 401 response intelligently and redirect the user to the login page to authorize the application.
Auth tokens are most commonly invalidated because either the expiry time has elapsed or too many tokens were created (when a new one exceeds the maximum, the oldest valid token will be invalidated).
Thank you for your response. We are using the Javascript SDK so the authorization is applied by that framework. The user is logged in and can use the integration.
However: even though the User Token can not yet be expired (it is set to 24 hours) we are receiving the 401.
You mentioned that there is a maximum of allowed tokens. What is the maximum and can I set it somewhere? Can I view the reason why it was invalidated somewhere?
Thanks in advance.
I believe it is 10 per user/client, but this is an internal limit that is subject to change. A well-formed application should not need to be aware of this.
No.
No. If you believe the product is misbehaving and invalidating your tokens erroneously, please open a case with PureCloud Care.
Thanks again for the explanation.
You mention that the tokens are per user/client. How should I interpret this? Is this 10 per PureCloud user or 10 per OAuth application?
Per user-client combination. If you, as a specific user, authenticate using a specific ID, you're allowed your own 10 tokens. Another user authenticating with their credentials, but the same client ID, will have their own 10 tokens. Then if you authenticate using your credentials, but with a different client ID, that application will have a limit of 10 tokens that is separate from the first application's limit.