search

jazzband / django-oauth-toolkit

OAuth2 goodies for the Djangonauts!
https://django-oauth-toolkit.readthedocs.io
Other
3.13k stars 792 forks source link

feat: Multiple Client Secrets per Application #1507

Open dopry opened 2 days ago

dopry commented 2 days ago

Use case

As an application owner I would like to deploy a new client secret, update each of my deployments in turn, and finally remove the old one so that I do not cause downtime for my applications.

Proposal

Add a client secret model to with a 1 to many relationship to the Application model so that applications can have multiple client secrets. A user should never be able to delete all the client secrets, there should always be at least one.

@n2ygk I would love your thoughts on this.

n2ygk commented 2 days ago

Sounds like a cool idea. Conceptually analogous to rotating out refresh tokens.