updated 9-25-25
Credly uses Auth Tokens that expire every 180 days for increased security. If tokens are not rotated prior to expiration, this can lead to missed rotations and outages. OAuth offers enhanced security without these recurring issues.
Auth Tokens vs OAuth (Side-by-Side)
| Theme | Auth Tokens | OAuth |
| Expiration & Rotation | Expire every 180 days Must be rotated manually | OAuth Application credentials do not expire. Access tokens are short-lived |
| Reliability | Outages if rotations are missed, or during rotation process | No outages |
| Governance | Many tokens per integration, making governance tricky | Admins can create a single application per integration, simplifying governance |
| Communication | Custom reminder processes required | No reminders needed |
Auth Token Pain Points vs OAuth Solutions
Pain: Frequent expiration (180 days) leads to constant token stress
Solution: OAuth removes manual rotations entirely
Pain: Immediate cutover disables old token, risking downtime
Solution: OAuth credentials are valid indefinitely unless deleted by you
Pain: Multiple tokens across teams with unclear ownership and many expiration dates
Solution: No need to create additional OAuth applications after initial configuration
Pain: No automated reminders for expiring tokens
Solution: OAuth makes reminders unnecessary
Pain: Documentation confusion and inconsistent practices
Solution: OAuth 2.0 is an industry standard with widely understood flows
Effort & Limitations
| Pilot integration | about 1 developer day |
| Additional integrations | ½–1 day each |
| Complex environments | 1–2 weeks across multiple services (estimate) |
NOTE: No downtime required: Auth Tokens and OAuth can run in parallel
Possible limitations to assess up front:
- Jobs or runtimes without state for token caching (workarounds exist)
- Strict change-control processes that require formal approvals and coordination
ROI
By investing in a one-time migration to OAuth, you can eliminate the recurring operational burden of manual token management. This shift removes the need for rotations, reminders, and troubleshooting tied to 180-day expirations. The return is permanent efficiency, stronger security, and fewer disruptions.
Token expiration was designed to increase security, but OAuth achieves the same security automatically without the operational pain. Make the switch once and remove the problem for good.