<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">After last weeks call, I scanned through the document and I don’t find any OAuth2 dependencies any more. It turns out that a lot of common implementations of RFC8935/8936 assume tokens will be used to identify streams.<div><br></div><div>I added an issue (<a href="https://github.com/openid/sharedsignals/issues/104">https://github.com/openid/sharedsignals/issues/104</a>) which suggests we should add some claifications for event transmission 8935/8936. A lot of implementations I have seen (including my own) use common endpoints and tokens to identify streams. It has been bugging me as to how things like token rotation will be handled. How to handle diagnostics if the token is opaque to the client. When streams are identified by token, it is harder to distinguish: Do I have the right stream, is the client authorized for the stream, is the authorization valid or expired.</div><div><br></div><div><div>
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Phillip Hunt</div><div>phil.hunt@independentid.com</div><div><br></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br></div></body></html>