I’m trying building myself a React App. Currently there’s no server side stuff like Express or a DB on my agenda.
My goal is to use ESI. API calls without authorizations are no problem. However I’m struggling with stuff like asking for the current orders of a character.
I’m looking for a general guidance from Javascript/webdevs how I could tackle authorization.
In order to make the auth worth while you need a way to store the refresh token to generate a new access token when they expire. Otherwise you will be using implicit auth, which means the user would have to log in every 20min to get a new token.
Whether this is a full fleged database like MySQL or PostgreSQL, or something like http://lokijs.org/ is up to you.
I never used it so couldn’t say. ESI uses OAuth2 so could use anything that supports that.
I understand that I can keep someone logged in with the refresh token. How is that working with an offline app like jEveAssets? I don’t have to log in after the next day.
Well the refresh token doesn’t keep someone logged in per say in the sense of like logging into Facebook. It just allows you to log in once, and use the refresh_token to generate new access_tokens used for auth’d endpoints when/as they expire.
I can’t speak for how jEveAssets does it specifically, you would have to ask @Golden_Gnu.
Okay. But let’s say an app fetches character contracts every hour. Would it be totally viable to use refresh tokens all the time? Or is there another way to keep access for a longer period than 20 minutes?
Got it! With the refresh_token I can get a new access_token which I need for ESI. The refresh_token will only work as long as the player/account allows access to my Third Party Application.
Feel free to request an invite to the slack server. The channels you’d want to hop into for quicker answers to questions would be the #esi and #sso channels (for api and authentication questions, respectively).
