We’ve got some important changes to announce. Please have a read below, and if there are any questions, please reply and we can hopefully answer your queries!
In accordance with regular security reviews of our systems, we at FreeAgent have decided to update our token lifecycles and procedures. Don’t worry, things won’t break overnight, but as developers, there are some elements of your applications that you may have to make changes to.
Authorisation Tokens: These tokens allow the application to initially be granted access to FreeAgent data.
Action: The lifetime on these tokens will be revised down from one hour to fifteen minutes. No action by developers is needed here other than to note the lifetime changes.
Access Tokens: These tokens allow your application access to FreeAgent data.
Action: The lifetime of these tokens will be revised down from seven days to one hour. No action by developers is needed here other than to note the lifetime changes.
Refresh Tokens: These tokens allow the application to gain new Access Tokens and continued access to FreeAgent.
Action: Refresh tokens now return their lifetime, and are also returned when an Access Token is regenerated. Previously, when generating a new access token, the request and the response was as follows:
An application makes an HTTP Basic Auth POST to the FreeAgent Token Endpoint (https://api.freeagent.com/v2/token_endpoint) using the Client ID as the username and
Client Secret as the password and including the following in the POST body:
* grant_type=refresh_token (required)
* refresh_token=the refresh token code (required)
For Example
Content-Type: application/json
grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA
If successful, the server would have returned a JSON response containing the new Access Token:
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"bearer",
"expires_in":604800
}
However, the new system slightly differs. The request made by the application is exactly the same
Content-Type: application/json
grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA
But, If successful, the response will be different. The server will return a JSON response containing the new Access Token, a Refresh Token and expiry fields for both:
{
"access_token":"2YotnFZFEjr1zCsicMWpAA"
"token_type":"bearer"
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA"
"refresh_token_expires_in":775630
}
You should store these values in your application. Going forward, we may decide to reduce Refresh Token lifetimes and expiry will become important in those contexts.
Cheers,
Phil
