Implement OCPI 2.2.1 token authorization flow between a CPO and an eMSP so RFID tokens can be validated in real time at a charge point

Steps

1. Complete the OCPI 2.2.1 credentials handshake between CPO and eMSP first (exchange TOKEN_A, TOKEN_B, TOKEN_C) so both parties have authenticated communication channels; the token authorization flow depends on this established connection.
2. The eMSP pushes its token database to the CPO using PUT /ocpi/{version}/tokens/{country_code}/{party_id}/{token_uid} for each token; the CPO stores these tokens locally for offline authorization to reduce latency at the charge point.
3. When an EV driver presents an RFID card or token at a CPO charge point, the CPO first checks its local token cache; if the token is found and the whitelist status is 'ALLOWED', authorize immediately without a remote call.
4. For tokens not in the local cache or with whitelist='NEVER' (requiring always-online authorization), the CPO sends a POST /ocpi/{version}/tokens/{country_code}/{party_id}/{token_uid}/authorize request to the eMSP's tokens module; include the optional LocationReferences body to indicate which EVSE the authorization is for.
5. Parse the eMSP's AuthorizationInfo response: check the 'allowed' field ('ALLOWED', 'BLOCKED', 'EXPIRED', 'NO_CREDIT', 'NOT_ALLOWED') and, if allowed, extract the Token object which may include a displayText (shown on the charge point display) and an authorization_reference for CDR matching.
6. Log the authorization result and link it to the subsequent session and CDR using the authorization_reference; if the eMSP returns a response time exceeding the charge point's timeout threshold, fall back to the local cache result if one exists — document the fallback policy with the eMSP.