Skip to content

Deprecate X-Access-Token Header for Authorization Header Only

Always use Authorization: Bearer JWT header format for sending requests for both user based and non-user based requests.

Expected Behavior

When a platform ships they SDK has a JWT set with just the channel and platform defined in its payload. When a user logs in and is authenticated Oddworks should send the platform back a new JWT with the same channel, platform, and now a user set to identify it as an authorized user. The SDK would use the new JWT for all future requests.

Shipped JWT Payload: {channel: 'odd', platform: 'roku'} Authenticated JWT Payload: {channel: 'odd', platform: 'roku', user: 13}

Current Behavior

Because of an old caching configuration a custom X-Access-Token was used for the JWT that was shipped with the device. Then once a user authenticated the SDK would sent a 2nd JWT in the Authorization header requiring Oddworks to decode both of them.