Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

OAuth in M2M is generally about separating out policy from the API interface, including the database of credentials which are valid, which clients are allowed which authorizations. That includes being able to make changes to these over time, without redeploying the API system.

Note that OAuth and JWT are independent like Peanut Butter and Chocolate. I assumed you are talking about JWT access tokens issued from OAuth client credentials.

> Is the "Bearer " authorization prefix going to stick?

The Bearer authorization method has a certain format and behavior. It is unlikely to be changed to meet some desire for aesthetics. Conversely, it MUST be changed if you are sending data in a different format or with different behavior, such as with the DPoP extension to OAuth.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: