Cognito Client Integration - Best Practices

Best Practices

The following are a list of best practices which are suggested when building a client to USTA:

• Check for a 401 after every API request

  • Get a new token - once only

  • Retry the API request - once only

• Protect your access tokens and refresh tokens

  • Once delivered to the client app, the tokens provide access to your information an the client app is responsible for keeping them safe

• Access tokens are valid for 1 hr before requiring refresh via refresh token

• Always use HTTPS rather than HTTP

• API raises exceptions for many different reasons, such as invalid parameters, authentication errors, and connection failure. We recommend writing code that gracefully handles all possible API exceptions. See error codes page for a complete list.

• Large data sets are paginated. Read the data in chunks following pagination implementation.

Token TTLs

The following are time-to-live (TTL) settings for token expiration. The JWT token has a claim (field) that needs to be checked to when it expires. It is expressed as a NumericDate measured in UTC time format.

Pagination

Pagination is implemented on endpoints that contain potentially large result sets.

"pagination": {
    "currentPage": 0,
    "pageSize": 0,
    "totalPages": 0,
    "totalResults": 0
}

Where:

• currentPage - the index of the page within the set.

• pageSize - the number of items on each page.

• totalPages - the upper bound of pages for looping.

• totalResults - the aggregate number of items returned across all pages.