Design a Multi-Region API Whose Clients Need Tokens From a Flaky Third Party
Your API runs in several regions. Every call carries a token issued by a third-party identity provider that is sometimes slow or unavailable, and your API must validate those tokens. Design the server side so that provider incidents cause as little downtime as possible, without weakening security in ways you cannot explain.
Cover token validation for signed (JWT) and opaque tokens, what you cache and for how long, request hedging and retries, idempotency for mutations, and a degraded mode.
Hints
Hint 1
JWTs validate locally with the provider's signing keys; cache the keys with a long TTL and refresh them in the background so a provider outage does not stop validation.
Hint 2
Opaque tokens need an introspection call; cache the result for the token's remaining lifetime, bounded by a maximum you choose, and serve from the cache during an outage.
Hint 3
Idempotency keys on mutations make hedged and retried requests safe; a degraded mode serves from cached permissions and refuses only what it cannot vouch for.
Asked at
Sign in to talk to the interviewer — ask what's in scope, what scale to design for, or for a nudge when you're stuck. Conversations save to your account.