CA API Management OAUTH Toolkit - Token Security
search cancel

CA API Management OAUTH Toolkit - Token Security


Article ID: 214223


Updated On:


CA API Gateway


Administrators and security operations teams may be concerned with how the OAUTH tokens are stored in the OTK Database regarding the ability for bad actors to perform malicious activities such as intercepting and cross-site schemes. 




Release : 9.4 and 10.x

Component : CA API Layer 7 OAUTH Toolkit


OAUTH tokens do not require encryption in the OTK database because they are random UUID's generated as opaque tokens and not related to any identifiable client info.

The OAuth 2.0 Authorization Framework

You can search for the word Opaque in this reference material for a deeper understanding.

Additional Information

Opaque Token

An opaque value used by the client to maintain state between the request and callback.  The authorization server includes this value when redirecting the user-agent back to the client.  The parameter SHOULD be used for preventing cross-site request forgery

OAuth Request Scenarios