API Platform: Shorter Authorization Tokens
API Platform now issues shorter authorization tokens. OAuth2 client IDs and secrets go from 64 to 50 characters. The level of security is unchanged, because tokens now use URL-safe base64 encoding.
- Applies to new tokens only. Existing tokens keep working as they are, with no action needed. Newly issued and newly refreshed tokens use the shorter length.
- Same security, simpler encoding. URL-safe base64 keeps tokens random and secure while making them shorter and safe to use in URLs.
- Check any length validation. If your integration validates token length (for example, expecting exactly 64 characters), update that rule before you issue or refresh tokens. If you replace tokens by creating a new API client (key) alongside the old one, you can roll over without interrupting live integrations.