Are we providing a guarantee against collisions in authentication tokens between clientId's?

[josephdenne]

And if not, would it even matter?

[jimlambie]

Currently, no guarantee against a collision. Would it matter? Possibly. We could check the generated token against the token store and generate again as required.

[josephdenne]

I think would be a good idea. While the potential for collision is very small, guaranteeing against it would seem sensible.