I am trying to find a way to handle a weird edge case (using OAuth) and I cannot find any "simple" way to do so.
The system consists of a client app and its client API, and then an external service's API.
The normal use case is:
- A user authorizes the client app (mobile using PKCE) to use the external API. Token received.
- The client app pushes the token (access and refresh) to the client API.
- The client API gets to do token refreshes and handle data communication with the external API. Basically acts as a proxy for the app.
The edge case appears in the off-chance you want to be able to call the external API from both the client app and API. If either gets to refresh the token then the other loses access.
Any way to keep the single token synced without interaction between the client app and API? I cannot seem to find anything in the OAuth 2.0 spec. Does it have any provisions for that or you need a separate token for each client?
If multiple tokens is the only way; how would one go about authorizing a user once and then give that access to multiple clients without having to actively ask a user to take action for each single one (exchange multiple tokens in one flow)?
Extra question in case single token is possible. What if the 2 clients need different combinations of scopes?
Thanks!