-
-
Notifications
You must be signed in to change notification settings - Fork 1.6k
feat(sentry apps): Update the refresh token docs to have manual refresh #15390
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
docs/organization/integrations/integration-platform/public-integration.mdx
Outdated
Show resolved
Hide resolved
docs/organization/integrations/integration-platform/public-integration.mdx
Outdated
Show resolved
Hide resolved
Bundle ReportChanges will increase total bundle size by 699 bytes (0.0%) ⬆️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: sentry-docs-server-cjsAssets Changed:
view changes for bundle: sentry-docs-client-array-pushAssets Changed:
|
docs/organization/integrations/integration-platform/public-integration.mdx
Outdated
Show resolved
Hide resolved
| ### Refreshing Tokens Manually for Integrators | ||
| Sometimes incidents or other technical anomalies can lead to token refreshing being committed on the Sentry side but then the token is lost in transmission on the way back. As a result, we've added a method for integrators to explicitly refresh and request a new token for their installers. | ||
|
|
||
| This manual refresh method uses a different authorization scheme where you will need to send a JWT signed with your client secret to the previous |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a reason for someone not to use this every time to get a refresh token? I mean should we recommend that instead of asking them to refresh after fail?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah I thought about this for a bit and I'm not sure tbh, I assume refresh tokens are preffered but yeah this feature does basically the same thing. I'll ask security.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Michelle and I poked into this a bit and it looks like for the Oauth 2.1 spec it's required to have the refresh_token and authorizations grant so we should keep those and have those as preferred. It seems like it would be preferable to move toward the client secret JWT method for authentication as a future TODO. I will mark the refresh_token grant_type/method as preferred.
DESCRIBE YOUR PR
Adds docs to the integration platform telling integrators how to use the new manual refresh method to refresh their installers tokens.
IS YOUR CHANGE URGENT?
Help us prioritize incoming PRs by letting us know when the change needs to go live.
SLA
Thanks in advance for your help!
PRE-MERGE CHECKLIST
Make sure you've checked the following before merging your changes:
Images