token management

[pfefferle]

The WP-API team provides a OAuth 1 lib that should work independent/separate from the WP-API plugin https://github.com/WP-API/OAuth1

[aaronpk]

You shouldn't need to turn the Wordpress site into an OAuth 1 server. Not sure why that would be helpful.

[snarfed]

@aaronpk i don't personally care whether it's oauth or something else under the covers, but i do need something that can mint, serve, verify, and manage tokens, right?

honestly, my first pass will probably be to hard-code a single static token and use that for everything. i'd then add real token management later. even at that point though, i'd just as soon not build it myself.

[aaronpk]

The wordpress plugin will need to be able to accept an access token in the HTTP header and verify it. The short path to implement this is to use the token endpoint I run at https://tokens.indieauth.com, that way you can just avoid all token management for now, and add that in to the plugin later.

[snarfed]

ooh, delegation, nice! thanks for the pointer.

[aaronpk]

Nice!