Skip to content

Make client-credentials token refresh buffer and jitter configurable #388

Description

@dpkass

Checklist

Describe the problem you'd like to have solved

In SDK 0.9.11, the client-credentials token expiry buffer is hardcoded to 300 seconds, plus 0–299 seconds of jitter. With Keycloak issuing 300-second access tokens, a freshly cached token is immediately considered stale. Sequential API calls therefore request new tokens instead of reusing them.

Describe the ideal solution

Allow configuring the refresh buffer and jitter, for example a 30-second buffer with a small jitter for five-minute tokens.

Alternatives and current workarounds

Increasing the Keycloak client's token lifetime avoids the mismatch, but requires longer-lived tokens to accommodate the SDK.

References

https://github.com/openfga/java-sdk/blob/v0.9.11/src/main/java/dev/openfga/sdk/api/auth/AccessToken.java

https://github.com/openfga/java-sdk/blob/v0.9.11/src/main/java/dev/openfga/sdk/constants/FgaConstants.java

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions