Deprication Admin App

Authentication & Access
1

I want to express my concern about this deprication change. I understand the move to dev-dashboard but the fact you cannot create an access token for machine2machine integrations is in my opinion completely unacceptable. Most of those apps are not apps at all but integrations.

In my opinion this is not improving security at all:

  1. You get a wild grown of the basic app templates to get the access token via console.log or db. So you skip the on time reveal and have lots of simple db’s just for the token whits the merchants needs to keep save next to the integration party.
  2. Because of the hoops merchants will create one token with all scopes and use that for multiple integrations.

It feels like the wrong direction in all regards. An IT department of a big semi-goverement company came with the idea to force users to change there password every 2 months and could not overlap more than 20% and could not been previous passwords. From technical standpoint this sounds great. In practice: sticky note of the new password under each keyboard.

1 Like
2

We added support for the OAuth 2 Client Credentials grant to support the system-to-system use case you’re describing. It does require an extra API request to acquire access tokens relative to custom apps in the admin, but we feel strongly that this is a net positive change relative to the security risk that unlimited TTL tokens present.

1 Like
3

@TerenceShopify I see and this makes thinks a little bit better.

Question: Can we generate multiple valid access tokens after each other and will they all be valid simultaneously? Ideal for stateless apps on for example Cloud Run / Cloud Functions. Aka generate an access token while spinning up and store in memory.

Nevertheless I for see the new GenerateAccessToken Apps ~ You select the scopes, we provide the tokenapps in the app store, would you agree?

4

Yes, you can have multiple active tokens at the same time. Requesting a new token does not invalidate older tokens. Note that within 60s the same token will be issued, although this should work fine for your stateless use case.