I have an API that uses oAuth2 and my own mobile apps that use this API as their backend. Since users can be logged on via multiple devices (i.e iPhone, iPad, android tablet or android phone) at the same time, I need the API to distinguish between each connection. I would like to do this via separate access tokens: each client gets a separate access token.

The problem is that the current implementation we use (spring-security-oauth2) generates a unique key based on client_id, username, and scope. So basically, when getting an access token, all clients get the same access token for the same user. This is done using DefaultAuthenticationKeyGenerator.

Is it safe to ignore the authentication key generator and simply create a new access token on each request from a client?

  • 2
    can you use scope to differentiate each client? i.e. give ios an "ios" scope, android an "android" scope, the tablet a "tablet" scope, etc. But FWIW I ended up writing my own TokenServices implementation (actually I think I made it a wrapper around the default) that generated a brand new token every time. – Rob Feb 9 '16 at 19:28
  • In general, though, the Spring Security OAuth2 implementation worked well for me (once I got through the XML configuration), but managing the token and authentication objects was an ongoing pain point. – Rob Feb 9 '16 at 19:29
  • 2
    Searching Google for "DefaultAuthenticationKeyGenerator" led me to a .java file in the spring-security-oauth library on GitHub. That class implements the AuthenticationKeyGenerator interface. Could you create your own implementation and use that instead? – Greg Burghardt Jan 12 '17 at 18:05
  • The URL to the .java file I found: github.com/spring-projects/spring-security-oauth/blob/master/… – Greg Burghardt Jan 12 '17 at 18:06
  • 2
    I am agree with @Rob you can go with devicetype in request like "android", "ios", "web" etc – Vikash Rajpurohit Jan 17 '17 at 14:18

Spring cloud provides already this behavior. Just add different Clients. Like iosAppClient, androidAppClient in your AuthorizationServerConfiguration class.

public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
                    .scopes("read", "write")


In the backend you can get the clientID like the following

clientId = ((OAuth2Authentication) authentication).getOAuth2Request().getClientId();

and implement different behavior based on the clientId.


One answer is that each app platform is a different client, so should have a different client id. One for the iOS app, one for the web site, etc.

As to differentiating between say an iPad vs an iPhone, I would suggest not relying on the OAuth system for this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.