oauth-token

An OAuth2 token

The client credentials grant of OAuth2: the client id and its secret in Basic, the form body written by url.query. The collector watches how long the tokens the server hands out live, read in the token itself.

How to read it

• url.query(array('grant_type' => …, 'scope' => …)) writes grant_type=client_credentials&scope=monitoring%20read: each key and value encoded, the pairs sorted by key and joined by &. Never build a form body or a query by concatenation alone: a &, a = or a blank in a value would break it.
• The type of the body is the header Content-Type: application/x-www-form-urlencoded, written by the author.
• A JWT is three parts joined by points; text.split cuts them. The middle one is JSON in base64 for addresses: base64.url_decode, then json.read.
• exp and iat are seconds since 1970: their difference is the lifetime of the token.

To adapt it

• A server that sends the client secret in the body instead of Basic: put client_id and client_secret in url.query. The body then carries a secret, the whole answer becomes a secret, and its lifetime can no longer be returned as a value.