title: Oauth2 - long lived Tokens vs Reauthentication in a Client Credentials Flow
body: <p>We've secured our REST server with <strong>OAuth2</strong> and implemented the <strong>client credentials</strong> grant type for several client apps that we control. Now we're faced with the decision to either make the tokens <strong>long lived</strong> (i.e. they expire "never") or to have the clients <strong>reAuthenticate</strong> very often (depending on the refresh token expiration). The first means that a captured token could be used by a malicious party the second means exposing the client secret very often which then in turn can be used to obtain tokens. </p>
  
  <p>Which is more secure in a resource-server to client-server authentication? 
  Both token and client secret can be invalidated if we suspect a theft. Obviously all communication is done via <strong>https</strong>..</p>
  
  <p>Currently we're thinking the client secret is more powerful than the token and thus a long lived token should be better for this two-legged scenario. (For any three-legged grant type which we'll implement soon we'd prefer a short lived token acting as the user session).</p>
  
  <p>Thanks for your thoughts! </p>