[keycloak-user] OAuth Tokens and IoT Devices

Hi, what is the current best solution in Keycloak to support a scenario where devices needs to authenticate using OAuth against an API? At the time being, to simplify we use offline-refresh tokens and every time, it the token is expired, generated out of that a new token. In term of performance the trick we use is to cache the access token and refresh it when needed with a background process. This process, unfortunately, for some tiny computational devices can be quite demanding and slow down the most important goal of sending data to the API at given intervarls. A better solution could be having a way to create never expiring access tokens (or with a manually defined expired date), we understand that may introduce security issues, but it would be only for specific scenarios (and I doubt it will introduce more issues that the offline token). Feelings? Suggestions? Cheers, Federico -- *Dr. FEDERICO MICHELE FACCA* *Head of Martel Lab* 0041 78 807 58 38 *Martel Innovate* <https://www.martel-innovate.com/> - Professional support for innovation projects Click to download our innovators' insights! <https://www.martel-innovate.com/premium-content/> Follow Us on Twitter <https://twitter.com/Martel_Innovate>