Token Overview
Introduction
This document presents an overview of the different tokens used in the T-Mobile API security process, also known as T-Mobile API Access Protocol (TAAP).
Some Background
T-Mobile uses a proprietary security authentication mechanism called TAAP which is short for T-Mobile API Access Protocol.
The T-Mobile API Access Protocol (TAAP) is designed to address several limitations and security issues with previous approaches of two-way SSL or OAuth 2.0 opaque bearer tokens. TAAP leverages OAuth 2.0 but also incorporates additional aspects of the below technologies to achieve API security:
- JSON Web Tokens (JWT)
- A description can be found here.
- Digital signature using an asymmetric key pair
- The JWT's token integrity is established using a digital signature cryptography mechanism or RSA (Rivest–Shamir–Adleman) algorithm.
- T-Mobile recommends that you learn more about the OpenSSL toolkit here.
- OpenID Connect 1.0 (OIDC)
- Access Token
- Identity (ID) Token
- A description can be found here.
- Proof of Possession (PoP) Token (a T-Mobile proprietary token format)
- Learn more about the PoP Token here.
T-Mobile uses an Open ID Connect (OIDC) aligned JWT (JSON Web Token) Access Token over OAuth 2.0 along with a proprietary Proof of Possession (PoP) Token to secure APIs. Proof of Possession (PoP) token essentially acts as digitally signature of the entire API request. A T-Mobile API Access Protocol (TAAP) compliant request to the resource server (REST API) allows the resource to verify not only that the client has been authenticated by the authorization server (using Access/ID token) but also whether the request has originated from the client who possesses the signing key (using a PoP Token).
Token Description
Token Type |
Token Description |
HTTP Header |
Token Validity |
---|---|---|---|
Proof of Possession (PoP) Token |
|
|
|
OAuth 2.0 Access Token |
|
|
|
OAuth 2.0 ID Token |
|
|
|