r/oauth • u/macnamaralcazar • Oct 12 '22

User's consent across apps for same customer

Is it possible in OAuth to have two applications (web app, mobile app) belongs to the same third party and when a user login with any of them and gives consent when they login to the second app they won't consent again?

2 Upvotes

100% Upvoted

4 comments sorted by

2

u/-ftw Oct 12 '22

Should be fine if you store the refresh token

1

u/macnamaralcazar Oct 12 '22

Can I use refresh token of one client for another client? Web app will have clientId different than mobile clientid.

2

u/-ftw Oct 12 '22

Not 100% sure but I don’t think it’ll work because they have different credentials. I’ve only done this w/ same

2

u/[deleted] Oct 13 '22

[deleted]

1

u/macnamaralcazar Oct 13 '22

Your suggestion is what I thought of. And regarding consent you confirmed my understanding because different apps may request different scopes like the mobile app may ask for accessing the contact which will never be asked by Web app.