ASYNCHRONOUS USER PERMISSION MODEL FOR APPLICATIONS

摘要

Use of an application to engage services on behalf of a third party is contemplated. The services may be engaged one behalf of the third party with delivery of a third party permission to a Web service, optionally with the third party permission being recognized in the form of an access token (accessToken) provided from the application to the Web service without requiring the application to interact with an user-agent used to obtain the third party permission.

主权项

1. A method for providing an access token to an application without requiring the application to interact with a user-agent through which a third party contemporaneously authorizes use of the access token, the method comprising:
retrieving an application authorization universal resource locator (appAuthURL); retrieving an access token universal resource locator (accessTokenURL); providing an application ID and a shared secret to the appAuthURL, the application ID identifying an application requiring access to a service, an authorization server at the appAuthURL generating an application token (appToken) and an event URL (eventURL) when the shared secret is verified, the appToken granting permission to the application to perform an event at the eventURL related to the service; polling the accessTokenURL to obtain an access token (accessToken), the accessToken indicating third party approval for the application to perform the event on behalf of the third party, the authorization server at the accessTokenURL providing the accessToken to the application as a part of the polling if the appToken is verified and the third party contemporaneously engages a user-agent to authorize the application, the accessToken being provided to the application without the application performing a related interaction with the user-agent; and providing the accessToken to the eventURL, thereby enabling the application to perform the event.