Hi, We have a SPA, where we only want let the user launch searches if they are authenticated (google, facebook or passwordless magic link). Once the user logged in, we really want him to stay logged in for even 365 days, if possible. The logged in users have access to his search history and saved s…

Hi @tibor The first solution is wrong, don’t use it. An ID token is not designed to grant access to an API. Always use an access token. The second solution looks okay to me, you can also use non-rotating refresh tokens (less secure, but would last longer than 365 days), or Auth0 long lived session…

Id Token for backend API

Get Help

Topic		Replies	Views
Is this SPA authentication flow secure? Get Help password , authentication , flow	10	6303	March 2, 2018
Is it possible to use Auth0 for long-term web authentication? Get Help	2	3764	February 9, 2019
SPA+API architecture with PKCE and refresh token Get Help	3	3337	September 9, 2020
How to securly handle tokens in SPA Get Help	8	6140	January 9, 2020
Using Code Grant with SPA + REST API Get Help authorization-flow	2	3925	August 28, 2019

Id Token for backend API

Related topics