# OAuth token synchronization in APM HA pair **URL:** \ **Category:** Technical Forums\ **Tags:** security, big-ip-access-policy-manager-apm, application-delivery, oauth\ **Created:** [September 27, 2021, 7:25am UTC](https://community.f5.com/t/oauth-token-synchronization-in-apm-ha-pair/59593 "2021-09-27T07:25:47Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Illia](https://avatars.discourse-cdn.com/v4/letter/i/e79b87/32.png) [@Illia](https://community.f5.com/u/Illia)\ **Post date:** [September 27, 2021, 7:25am UTC](https://community.f5.com/t/oauth-token-synchronization-in-apm-ha-pair/59593/1 "2021-09-27T07:25:47Z")
Hello. I have an HA pair of APMs, acting as a OAuth authorization server. By default, devices in HA should synchronized OAuth tokens from Active to Standby. But I don’t see issued tokens on Standby device. The _ **statemirror.mirrorsession** _ system database variable set in “_ **enabled** _”. _:Active:In Sync] ~ #_ _ **tmsh  show apm oauth token-details db-instance \** _ _total-tokens:    7258_ _:Standby:In Sync] ~ #_ _ **tmsh  show apm oauth token-details db-instance \** _ _total-tokens:    0_ No synchronization errors (Failed to initiate DB synchronization (ERR\_DB)) in logs. How can I check, that token synchronization is successful and issued OAuth tokens existing on both device in cluster? ---
**Author:** ![Angelo\_V](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Angelo\_V](https://community.f5.com/u/Angelo_V)\ **Post date:** [September 27, 2021, 11:36am UTC](https://community.f5.com/t/oauth-token-synchronization-in-apm-ha-pair/59593/2 "2021-09-27T11:36:46Z")
Hi Illia, in addition to the HA-SYNC device group, have you also configured a sync-only device group? Angelo ---
**Author:** ![Illia](https://avatars.discourse-cdn.com/v4/letter/i/e79b87/32.png) [@Illia](https://community.f5.com/u/Illia)\ **Post date:** [September 27, 2021, 2:56pm UTC](https://community.f5.com/t/oauth-token-synchronization-in-apm-ha-pair/59593/3 "2021-09-27T14:56:43Z")
Hello, Angelo. There is only one sync-failover device group. Illia. ---
**Author:** ![Angelo\_V](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Angelo\_V](https://community.f5.com/u/Angelo_V)\ **Post date:** [September 27, 2021, 3:03pm UTC](https://community.f5.com/t/oauth-token-synchronization-in-apm-ha-pair/59593/4 "2021-09-27T15:03:24Z")
I think the problem is that. _To synchronize access policies between multiple devices, you configure a Sync-Only device group, which includes the devices between which you want to synchronize access policies. Device group setup requires establishing trust relationships between devices and creating a device group. You set the devices in each group to use_ _ **Automatic Sync** _ _and_ _ **Full Sync** __, and then synchronize access policies one at a time, resolving conflicts as you go._ _ **Important:** _ _Sync-Only groups must be configured before you pair Active-Standby devices. To add an Active-Standby device pair to a Sync-Only device group, first you must reset the trust between the devices. Next, you must remove the devices from the Sync-Failover device group. Next, you must add both devices to a Sync-Only device group. Finally, add the devices as an Active-Standby pair to the Sync-Failover group._ > **[404 Page not found | BIG-IP Documentation](https://techdocs.f5.com/kb/en-us/products/big-ip%5C_apm/manuals/product/apm-implementations-11-5-0/4.html#conceptid)** > > Usage information and technical documentation for BIG-IP and other related F5 products ---
**Author:** ![Illia](https://avatars.discourse-cdn.com/v4/letter/i/e79b87/32.png) [@Illia](https://community.f5.com/u/Illia)\ **Post date:** [September 29, 2021, 7:05am UTC](https://community.f5.com/t/oauth-token-synchronization-in-apm-ha-pair/59593/5 "2021-09-29T07:05:31Z")
Hello, Angelo. I’m not clearly understand your considerations. My devices is in one trust domain and in one Sync-Failover device group. > **[OAuth Overview | BIG-IP Documentation](https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-access-policy-manager-oauth-configuration/apm-oauth-overview.html)** > > Usage information and technical documentation for BIG-IP and other related F5 products As I can see here, “HA supports real-time synchronization of the BIG-IP configuration, including the OAuth database, and switching over seamlessly when needed.” Why we need additional Syn-Only device group? ---
**Author:** ![Angelo\_V](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Angelo\_V](https://community.f5.com/u/Angelo_V)\ **Post date:** [September 29, 2021, 8:52am UTC](https://community.f5.com/t/oauth-token-synchronization-in-apm-ha-pair/59593/6 "2021-09-29T08:52:47Z")
I think you are right, you don’t need an additional Sync-Only device group. Try to check the statemirror.mirrorsession system database variable, it should be enable **list /sys db statemirror.mirrorsessions** ---
**Author:** ![Illia](https://avatars.discourse-cdn.com/v4/letter/i/e79b87/32.png) [@Illia](https://community.f5.com/u/Illia)\ **Post date:** [September 29, 2021, 9:00am UTC](https://community.f5.com/t/oauth-token-synchronization-in-apm-ha-pair/59593/7 "2021-09-29T09:00:01Z")
Angelo, I’ve already checked it. The _ **statemirror.mirrorsession** _ system database variable set in “_ **enabled** _”. Do you have an ideas how to check database on Standby device? ---
**Author:** ![thecarrionkind](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@thecarrionkind](https://community.f5.com/u/thecarrionkind)\ **Post date:** [July 30, 2024, 4:08pm UTC](https://community.f5.com/t/oauth-token-synchronization-in-apm-ha-pair/59593/8 "2024-07-30T16:08:47Z")
Good question. Also interested in this issue. Bumping up.