Extended OAuth architecture support in a scalable environment

A method of sharing one or more valid tokens across multiple instances of an application in a dynamically scalable environment, the method comprising the steps of:

• if a computer, which includes an authorization server, issues a corresponding new refresh token for each request for a refresh of each access token, the computer (i) receiving a token request from a client interacting with instances of an application, the client being another computer, the token request including a field indicating a number of tokens required, and the number of tokens being an integer greater than one, (ii) in response to the step of receiving the token request, generating and sharing access and refresh token pairs so that a total number of the access and refresh token pairs equals the number of tokens required included in the token request, and (iii) sending the access and refresh token pairs to the client so that in response to token requests from the instances of the application, the instances of the application obtain respective access and refresh token pairs;
• or
• if the computer does not issue the corresponding new refresh token for each request for the refresh of each access token, the computer (iv) receiving from the client a request for a refresh token, (v) in response to the step of receiving the request for the refresh token, validating an existing access token which is bound to the refresh token, and (vi) in response to the step of validating, if the existing access token is expired, generating and sending to the client a new access token, or in response to the step of validating, if the existing access token is not expired, sending to the client the existing access token;
• the computer determining the existing access token is expired;
• based on the computer not issuing the corresponding new refresh token for each request for the refresh of each access token, and based on the existing access token being expired, the computer invalidating the existing access token;
• and
• based on the new access token being sent to the client and the existing access token being invalidated, sharing a valid access token with each of the instances of the application, the valid access token being the new access token.