(Additional Question: how do I make sure that the time which I calculate for the token expiration is accurate? Because the expire_in value probably starts from when the API server generated the key, and not when I receive it.)或每次尝试使用 access_token 进行 API 调用,如果返回错误,则使用 refresh_token.我也愿意接受其他实施方案.I am also open to other options of implementing this.推荐答案客户端应始终准备好处理从 API 返回的指示 access_token 验证失败的错误.根据实现,访问令牌可能已被撤销或以其他方式宣布无效.The client should always be prepared to handle an error returned from the API that indicates that the access_token validation failed. Depending on the implementation the access token may have been revoked or declared invalid otherwise.然后客户端可以使用 refresh_token 来获取新的访问令牌并重试.所以你可以选择实现 1. 但这并不能让你免于实现 2. ,所以你可以选择坚持只实现 2 并尽量减少所需的代码量.The client may then use a refresh_token to get a new access token and try again. So you can choose to implement 1. but it does not free you from implementing 2. as well, so you may choose to stick to only implementing 2 and minimize the amount of code required.当然,如果你想尽可能的避免错误的发生,你可以实现1.优化调用次数,减少整个过程中的错误次数.Of course if you want to prevent errors from happening as much as possible you could implement 1. to optimize the number of calls and reduce the number of errors in the whole process. 这篇关于OAuth 刷新令牌最佳实践的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持! 上岸,阿里云!