OWASP API2 2023 Short Lived Access Tokens

Using short-lived access tokens is a good practice. When using OAuth 2, this is done by using refresh tokens. If a malicious actor is able to get hold of an access token then rotation means that token might not work by the time they try to use it.

Message: Authentication scheme does not appear to support refresh tokens.

#OWASP #Security #OAuth #Tokens #OpenAPI

← Back to all Rules

MCP tools for rules

6 tools reach this content

find_building_blocksBrowse every rules entry — call it with type="rules".
get_building_blockOne rules entry in full; add include=content for the body (Pro).
search_api_evangelistSearch every content type across the network at once.
find_relatedThe shared-tag relevance graph — what else covers this.
get_tagEverything one tag labels, across all content types.
guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.

All tools & prompts

Call it yourself

curl for this page

This rule

curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-short-lived-access-tokens-error"

Full body (Pro)

curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-short-lived-access-tokens-error?include=content" \
  -H "x-api-key: $AE_KEY"

Related across the network

curl "https://api.apievangelist.com/v1/rules/owasp-api2-2023-short-lived-access-tokens-error/related"

All rules

curl "https://api.apievangelist.com/v1/rules?limit=25"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Discovery

Learnings

Guidance

Toolbox

Alignment

API Evangelist LLC

OWASP API2 2023 Short Lived Access Tokens

Rule Details

Explore more

Discover APIs

Work with this as data

MCP tools for rules

Call it yourself

Get an API key