Hacker News Reader

I'm curious why we are still messing around with all these tokens when we could be using asymmetric encryption, like Apple is using for their AppStore connect API https://developer.apple.com/documentation/appstoreconnectapi...

Just seems fundamentally more secure.

View on HN

For scenarios where third party clients clients require delegated access to users, you can combine these two approaches, giving you the best of both worlds.

For example we have configured our implementation of OpenID Connect to use PKCE for retrieving an authorization code, and then when calling the token endpoint, requires that the the client authenticate using a client_assertion JWT (as detailed in https://tools.ietf.org/html/rfc7523#section-2.2)

Reply on news.ycombinator.com