Access Token / Refresh Token description not required?

[Dave Tonge]

https://bitbucket.org/openid/fapi/annotate/d4edc14c0b76155c97623edb521bfdc56afd64b7/Financial_API_WD_001.md?at=master&fileviewer=file-view-default#Financial_API_WD_001.md-342

This paragraph seems unneeded - or at the very least should refer to: http://openid.net/specs/openid-connect-core-1_0.html#TokenLifetime

[Nat Sakimura]

Yes and no. While it probably is better to refer to the OIDC for token lifetime constraints, the TokenLifetime section in OpenID Connect Core does not talk about

• the implication of the bearer token
• the implication of the token being used against multiple resources

These builds up to bring in the notion of Holder of key token and resource audience constrained token respectively in Part 2. So, I would argue to keep the section and those descriptions here while we should refer to OIDC core for the recommendation on the token lifetime itself.

[Nat Sakimura]

re: #52

→ <<cset 81b537a7e335>>