token). Add logic to verify the token, then use the token to access information about the user’s devices in your resource server.
Get the access token from the directive
When your add-on or skill receives a directive from Alexa, it includes anendpoint section that contains a scope. The scope contains a bearer token that you can use to authenticate the user in your system.
Following is an example endpoint that contains a bearer token:
endpoint.scope.token.
Verify that the token is valid
After you have thetoken, verify that the token identifies a user in your resource server. The token could become invalid for multiple reasons, for example:
- The user deleted or canceled their account with your service. For example, an Alexa user might have set up account linking with My Lights, and then later canceled their My Lights account. At this point, the token stored by the Alexa service would identify a non-existent user.
- The token has expired, and the Alexa service was unable to obtain a new token. This can occur with an authorization code grant if your authorization server does not provide refresh tokens.
TurnOn directive, the add-on would connect with the device cloud to turn on a light.
Respond to the user if the token is invalid or expired
If the access token is invalid, return anErrorResponse with the type set to one of the following:
EXPIRED_AUTHORIZATION_CREDENTIAL(for an expired token)INVALID_AUTHORIZATION_CREDENTIAL(for an invalid token)
