No, there is no way to ask for a custom TTL, for example a 1-year lifetime. But: you can use the refresh-token endpoint to get a fresh token after your existing token expires.
The logic you use in your CI/CD pipeline should be smart enough to check for expiry on the token and auto-refresh it. Suppose your pipeline requires you to call 4 Administrative API calls in succession. Before each API call you probably want to check the expiry of the token, and if it will expire within 60 seconds, then you should refresh the token first, and then call the API call. For a larger margin of safety, you can turn that up to 180 seconds.
The access token is good for 30 minutes. But the refresh token, in my experience, is good for at least 7 days. Maybe more (sorry, I don't know for sure). This means if you have a 7-day old refreshtoken, you can get a new access token by just passing the refresh token to the /token endpoint.
For Apigee Edge Admin APIs, the logic to get a new token, or to refresh an existing token, looks like this (pseudo-code):
function refreshToken(expiredToken, cb) {
var formparams = {
refresh_token: expiredToken.refresh_token,
grant_type : 'refresh_token'
};
return invokeTokenEndpoint(formparams, cb);
};
function getNewToken(arg1, cb) {
var formparams = { grant_type : 'password' };
if ( typeof arg1 == 'string' ) {
formparams = merge(formparams, { username: conn.user, password: arg1 });
}
else if (arg1.passcode) {
formparams = merge(formparams, { response_type: 'token', passcode: arg1.passcode });
}
else if (arg1.password) {
formparams = merge(formparams, { username: conn.user, password: arg1.password });
if (arg1.mfa_token) {
formparams = merge(formparams, { mfa_token: arg1.mfa_token });
}
}
return invokeTokenEndpoint(formparams, cb);
};
This sort of logic is built into apigee-edge-js, a JavaScript library for invoking the Admin API of Apigee Edge, suitable for use from within nodejs scripts. It's also built into the Powershell module for the Apigee Edge Admin API.
Both of them follow the same kind of logic.
- upon first use, look in a well-known location for an existing token for the Apigee Edge Admin API
- is a token available?
- yes: check the expiry of the token. Is the token expired (or will it expire soon, like within 60 seconds)?
- yes: call the refresh token endpoint. stash the new token in the well-known location.
- no: nothing to do
- no (no token is available): obtain a new one using one of the mechanisms (username/password, passcode, MFA). stash the token in the well-known location.
- use the token
If you have some other scripting tool, you'd need to implement something to parallel that. OR, you could just use one of THOSE things, to refresh and stash the token, then use the stashed token from something else. (bash script, or C#, or whatever)
LinkedIn
Twitter
