Cotter's OAuth 2.0 Tokens Specification
Allowing Cotter handling your full authentication is the fastest way to get your whole authentication suite setup. Cotter can generate an access token, id token, and refresh tokens for you.
After successful authentication, Cotter returns ID, access, and refresh tokens as defined by the OpenID Connect (OIDC) open standard:
- The ID Token contains information about the authenticated user such as email , phone number ,
client_user_id(the user's id in your server), andauth_time(last authenticated time). - The Access Token contains scopes and the authentication method used to authenticate the user:
OTP,TRUSTED DEVICE,PINorBIOMETRIC.
🔒It is important to secure all tokens in transit and storage.
Currently, we have the following libraries available to handle Cotter's OAuth Tokens:
Cotter's Access token is a JSON Web Tokens (JWTs) that is used to tell your backend API that the user has been authorized to call the API and perform some action (defined in the
scopes attribute of the token). Token example:
Access Token
eyJhbGciOiJFUzI1NiIsImtpZCI6IlNQQUNFX0pXVF9QVU...
Example decoded token
{
"sub": "09efb1b-e50f-41fd-8530-88ffbcd80f59", // [Deprecated] Cotter's User id
"client_user_id": "09efb1b-e50f-41fd-8530-88ffbcd80f59", // deprecated
"authentication_method": "TRUSTED_DEVICE", // How the user is authenticated
"type": "access_token",
"identifier": "[email protected]", // User's email or phone number
"scope": "access", // Scope of this access token (coming soon)
"aud": "<your API KEY ID>", // Your API_KEY_ID
"exp": 1586231136, // Expires at
"iat": 1586227536, // Issued at
"jti": "47fba8ba-abcd-efgh-a22c-a2b8b72e8b98",
"iss": "https://www.cotter.app"
}
1. On every API call to your server, attach the access token as a header
Authorization: Bearer <access token>
2. In your server, using a middleware, check if the access token is valid
3. If the access token is valid, allow the API call to proceed.
Cotter's ID token is a JSON Web Tokens (JWTs) that is used to provide information about the user. ID tokens expires every 1 hour. Check the guide on renewing access and id tokens.
Example Decoded Token
{
"sub": "43e53999-c31e-4ed9-a196-71031a05f297", // [Deprecated] Cotter User ID
"client_user_id": "43e53999-c31e-4ed9-a196-71031a05f297", // Deprecated
"auth_time": "1591756112", // Last authenticated time (Unix timestamp)
"identifier": "[email protected]",
"type": "id_token",
"aud": "<your API KEY ID>", // your API KEY ID
"exp": 1586232181, // Expires at
"iat": 1586228581, // Issued at
"jti": "886773db-abcd-efgh-aefc-6ab481b24099",
"iss": "https://www.cotter.app"
}
You should not trust this information after it's expired
Cotter's Refresh Token is an opaque token (i.e. a random string) that is used to generate a new
access token and id token when they're expired. Refresh tokens expires every 30 days. You need to re-authenticate the user to get a new refresh token. Check the guide on renewing access and id tokens.14:Pmw3r3rgaw0rLupUDU4hjwJFisv8EaHRaoy5gw54ZmSebaWHDh
Easily get tokens using the SDK by adding a simple paramater, ex.
getOAuthToken = trueThe SDK generally automatically store tokens securely for you, and provides a function to easily remove the tokens to logout your users.
The SDK generally automatically renews expired
access_token and id_token whenever a valid refresh_token exists.You need to verify the JWT tokens in your backend server. Fortunately, there are a lot of good libraries that do this.
If you have additional metadata from your backend server that you'd like to add to the JWT token (for example, the user's
role or name, you can call Cotter's API to add the claims to Cotter's JWT token