Subject: [oauth-ext-review] Proposal for a small extension to facilitate token management

From: Breno de Medeiros <[email-masked]>
Date: Fri, 17 Apr 2020 12:05:14 -0700

In some situations we have encountered requests from clients to have more
metadata associated with tokens to facilitate human comprehension and
management.

I would like to suggest the following extension parameters for IANA
registration, respectively an additional optional request and response
parameter in the OAuth2 token endpoint:

token_description: Value is a quote-delimited, case-sensitive string
including spaces. This is supposed to be a human-readable description of
the token.

And a matched response parameter:

token_id: Value is base64 url-safe value representing a service-generated
id.

ASes that support token_description and/or token_id MAY return these as
part of token introspection endpoint responses or MAY display these to end
users if they provide a token management interface. Otherwise it is out of
scope for the specification where token_description or token_id is made
visible or available.

ASes that support these parameters SHOULD publish for which grant types in
the token endpoint they support these parameters.

Waiting on your feedback,

-- 

--Breno

---

From: Mike Jones <[email-masked]>
Date: Fri, 17 Apr 2020 19:24:34 +0000

Is there a public URL for the specification defining these parameters?  That is a required part of the registration request.

                                                       -- Mike

From: oauth-ext-review <[email-masked]> On Behalf Of Breno de Medeiros
Sent: Friday, April 17, 2020 12:05 PM
To: [email-masked]
Subject: [oauth-ext-review] Proposal for a small extension to facilitate token management

In some situations we have encountered requests from clients to have more metadata associated with tokens to facilitate human comprehension and management.

I would like to suggest the following extension parameters for IANA registration, respectively an additional optional request and response parameter in the OAuth2 token endpoint:

token_description: Value is a quote-delimited, case-sensitive string including spaces. This is supposed to be a human-readable description of the token.

token_id: Value is base64 url-safe value representing a service-generated id.

ASes that support token_description and/or token_id MAY return these as part of token introspection endpoint responses or MAY display these to end users if they provide a token management interface. Otherwise it is out of scope for the specification where token_description or token_id is made visible or available.

ASes that support these parameters SHOULD publish for which grant types in the token endpoint they support these parameters.

--

--Breno