Is possible to link application instances and tokens?

[banto_78]

Hi all,

i am wondering if and how in Apigee Edge is possible to associate (OAuth) tokens with application instances. What if a user has multiple applications hence multiple tokens and she would like to retrieve a list of all her app_instances and related tokens to e.g. remove a token for a certain app_instance? I cannot find anything out of box on the Edge API. Help very appreciated.

thanks.

[banto_78]

to add as example:

if i have a mobile and a tablet same app installed how do i know what token correspond to what device?

[anilsr]

@bantobanto , You mean search developer application by access token / consumer key ?

[banto_78]

Hi Anil,

yes i mean that an user would need to search his app (what we call app instance) for a specific Oauth access_token and not consumer key.

thanks

[DChiesa]

As you know you can associate any metadata to tokens. In Apigee Edge, this is done through "custom attributes" that you can attach to the token at the time the token is created.

I don't know what an "app_instance" is specifically. It could be you are referring to the client_id. For the tablet, there would be one client_id, and for the phone, a different client_id. You can attach the originating client_id to the token.

If the "instance" refers to something else, then you only need to attach that "something else" as an attribute on the token during creation.

Edge does not offer a user interface, out of the box, for displaying tokens and all their custom attributes. @arghya das may want to comment on how to query and list the tokens.

See also, this answer to a different question.

[banto_78]

thanks Dino. Unless i misunderstood something I do not agree with your statement "For the tablet, there would be one client_id, and for the phone, a different client_id". If the app is the same, isn't the client_id too across all devices? (if for client_id is meant the app_key: https://community.apigee.com/questions/23232/how-is-defined-client-id.html). pls explain.

thanks

[DChiesa]

The app key or client id can be the same, or it can be different, as you wish.

If it is the same, then yes, it will not be possible to distinguish between inbound API calls that originate from the phone vs the tablet. You could potentially introduce another data item in the app, to allow the server-side to understand that.