OpenFeed.Tokens (OpenFeed v0.1.0)

The result of a successful token exchange or refresh.

grant_id is the handle for the consumer's CDR disclosure grant.

Note that sharing-api access tokens are opaque, not JWTs, so there are no claims to read them from — OpenFeed.Auth recovers grant_id via token introspection, which is what OpenFeed's minimal {active, grant_id} introspection response exists for. Tokens minted for other audiences are JWTs and do carry the claim, so the claim is checked first to save a round trip.

sub is the only stable identifier OpenFeed gives a third party. Persist and match consumers by it: an email address can move between users over time, a sub never does.

Summary

Types

t()

Functions

expired?(tokens, slack \\ 120)

Whether the access token is expired, or close enough that it should be refreshed before use.

Types

t()

@type t() :: %OpenFeed.Tokens{
  access_token: String.t(),
  expires_at: DateTime.t(),
  grant_id: String.t() | nil,
  refresh_token: String.t() | nil,
  scopes: [String.t()],
  sub: String.t() | nil,
  token_type: String.t()
}

Functions

expired?(tokens, slack \\ 120)

@spec expired?(t(), non_neg_integer()) :: boolean()

Whether the access token is expired, or close enough that it should be refreshed before use.

slack guards against a token that passes this check and then expires in flight. Defaults to 120 seconds.