I'm building a system that horizontally scales with many nodes. Any of these nodes could consume an API that's hosted on https://example.com/api
. The authentication for this API is token based.
My question is, should each of my nodes authenticate separately and fetch their own token? Or should I build a shared cache between them and store the token there?
If latter, are there any standards for this design pattern, or better yet libraries that can do this for me? ie. stores the token in cache, and takes a lambda function + ttl for auth or renewal)
Notes:
- Tokens are valid for a certain number of hours.
- They're reusable during that time period, and then expire.
- They're all the same access level.
- The APIs that I've encountered so far, all allow for multiple active tokens at the same time, ie. if you get a new one, doesn't invalidate the old ones. (But I think I should account for this in case I see one in the future, not mvp)
- The nodes do run on different machines.
- The concern is not to have to make a separate Auth call on every API call
EDIT I've also ran into this article that talks about this problem in Azure world: https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/token-cache
Thanks!