We have some client apps that do not maintain token state so they always call the ORDS /oauth/token endpoint and use the Bearer token to authorize for the subsequent ORDS API call. Since each ORDS bearer token is valid for 3600 seconds. Lots of unnecessary tokens are generated. Although the ORDS_HOUSEKEEPING_JOB cleans up unused tokens, this is wasteful
Questions
Can the ORDS /oauth/token endpoint to re-use the same token IF the client provides it in a custom x-token or such header, instead of generating a new token?
Can the expires_in attribute of the token be configured or is it hard-wired to 3600?
Thanks