Deprecate X-Access-Token Header for Authorization Header Only
Always use Authorization: Bearer JWT
header format for sending requests for both user based and non-user based requests.
Expected Behavior
When a platform ships they SDK has a JWT set with just the channel
and platform
defined in its payload. When a user logs in and is authenticated Oddworks should send the platform back a new JWT with the same channel
, platform
, and now a user
set to identify it as an authorized user. The SDK would use the new JWT for all future requests.
Shipped JWT Payload: {channel: 'odd', platform: 'roku'}
Authenticated JWT Payload: {channel: 'odd', platform: 'roku', user: 13}
Current Behavior
Because of an old caching configuration a custom X-Access-Token
was used for the JWT that was shipped with the device. Then once a user authenticated the SDK would sent a 2nd JWT in the Authorization
header requiring Oddworks to decode both of them.