Cybersecurity glossary
What is an Access Token?
Learn what an access token is, how it authorizes API calls in OAuth and OIDC, differences from refresh and ID tokens, and security practices that limit theft and misuse.
Definition
An access token is a credential issued by an authorization server that a client presents to a resource server to access protected APIs, conveying authorization context such as subject, scopes, and lifetime without exposing the resource owner’s primary password.
Why access tokens matter
Modern APIs rarely ask for user passwords on every call. Instead, clients present an access token—a delegated credential that says which principal may perform which actions for how long.
Access tokens are the workhorses of OAuth, OpenID Connect, and service-to-service auth. Their design choices—format, lifetime, scopes, storage—directly determine how painful theft and replay become.
What an access token conveys
Authorization context
Subject, client, scopes, and other attributes the API needs for access decisions.
Lifetime bounds
Expiry (and sometimes not-before) windows that limit usefulness after theft.
Audience targeting
Indication of which resource servers should accept the credential.
Presentation form
Usually a bearer string in an Authorization header, sometimes a constrained token.
Typical access-token lifecycle
Client requests authorization
A user consents or a machine client authenticates to the authorization server.
Access token is issued
Token endpoint returns an access token (and optionally refresh/ID tokens).
Client calls the API
Resource requests include the token as a bearer credential.
Resource server validates
Signature/introspection, audience, expiry, and scopes are checked.
Authorized operation runs
Object- and function-level authorization still apply beyond scopes.
Expire or refresh
Short-lived tokens end; refresh flows mint replacements under policy.
Access token formats compared
| Format | Validation | Main trade-off |
|---|---|---|
| JWT access token | Local signature + claims | Fast, but revocation needs extra design |
| Opaque token | Introspection or shared store | Easy revoke; adds auth-server dependency |
| Constrained token (DPoP/mTLS) | Proof of possession + token checks | Stronger anti-replay; more client complexity |
Access token security checklist
- Keep access tokens short-lived; use refresh rotation for longer sessions.
- Issue least-privilege scopes and enforce them on every resource server.
- Validate audience and issuer for JWT access tokens (RFC 9068 profile).
- Never send access tokens to third-party origins or put them in URLs.
- Prefer BFF/HttpOnly patterns for browsers over long-lived JS-readable storage.
- Do not use ID tokens as access tokens for APIs.
- Monitor anomalous token use across IPs, devices, and geographies.
- Plan revocation or introspection for high-risk compromise scenarios.
The practical takeaway
An access token is a time-bounded API credential representing delegated authorization. It is not a complete security architecture by itself.
Scope tightly, expire quickly, validate thoroughly, and store carefully. Pair with solid object-level authorization so a valid token cannot freely access every object the API exposes.
Related security terms
OAuth 2.0
Authorization framework that defines how access tokens are issued and used.
JWT (JSON Web Token)
A common format for self-contained access tokens.
JWT Token Replay
Reuse of stolen access tokens while they remain valid.
OAuth Token Theft
How attackers steal and abuse OAuth tokens.
Audience Claim (aud)
Restricts which APIs should accept a JWT access token.
Frequently asked questions
What is an access token in simple terms?
It is a temporary pass that lets an app call an API on your behalf. The app shows the token instead of asking for your password on every request.
Is an access token the same as a password?
No. It is usually scoped, time-limited, and revocable. Still, treating it carelessly can be as damaging as leaking a password for the token’s lifetime.
What is the difference between access and refresh tokens?
Access tokens authorize API calls and should be short-lived. Refresh tokens obtain new access tokens and must be stored and rotated more carefully.
What is the difference between access and ID tokens?
Access tokens are for API authorization. ID tokens (OpenID Connect) assert user authentication to the client and should not be used as API access credentials.
Should access tokens be JWTs or opaque?
Both are valid. JWTs enable local validation; opaque tokens favor introspection and easier revocation. Choose based on scale, privacy, and revocation needs.
Where should browsers store access tokens?
Prefer hardened patterns such as Backend-for-Frontend with HttpOnly cookies. Avoid long-lived tokens in localStorage when XSS is a realistic threat.
What are scopes?
Scopes limit what an access token is allowed to do, such as read:profile versus write:payments.
References
Explore authoritative guidance and frameworks related to access token.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.