Current situation or problem:
In order to make D2IR API called to the central INN-Reach server, FOLIO must have a valid Bearer Auth token. These tokens are generated by POSTing a request to a configuration-specified API endpoint using a client key and secret combination. Key and secret should be concatenated together using a ":" and base64 encoded.

Sample request:

Sample Response:

Issued tokens are valid for 600 seconds. Expired tokens result in a 401 Unauthorized response from the server. Client should handle these responses and request a new token when needed.

In scope
API client for requesting OAuth2 Bearer Tokens from Central Server based on supplied Base64-encoded ket/secret pair

Out of scope
API Endpoint to provide OAuth2 Bearer Tokens to a client based on supplied Base64-encoded key/secret pair.

Use case(s)
All API calls from FOLIO to INN-Reach central server require an Oauth2 Bearer Authentication token to be included in the request headers. FOLIO must request a new token before attempting any other API calls.

Proposed solution/stories
Given a known API key/secret combination issued by the INN-Reach Central Server, the edge-inn-reach module should issue a request to the Central Server Oauth2 api to request a valid Bearer Auth token and store it for subsequent use, and request a new token when the previous one expires.

Questions

• How do we store the API key/secret pair issues by the D2IR Central Server?

• Should a new token be requested for each transaction with the server, or stored and re-used until expiration?