Cybersecurity glossary
What is a Security Token?
Learn what a security token is, how access tokens, ID tokens, and session tokens differ, common token formats, and security practices for issuance, storage, and validation.
Definition
A security token is a digital credential that a client presents to prove authentication or authorization state—such as an OAuth access token, OpenID Connect ID token, SAML assertion, or application session token—so a service can make an access decision without recollecting primary credentials.
Why modern systems run on tokens
After authentication, systems need a portable proof of identity or permissions. A security token is that proof: presented on API calls, SSO callbacks, or browser requests so primary credentials stay offline.
Token design choices—format, lifetime, binding, storage—often determine whether a breach is a blip or an account-wide takeover.
Common security token types
Access tokens
Authorize resource-server API calls with scopes and audiences.
ID tokens
Assert authentication events to OIDC relying parties.
Refresh tokens
Mint new access tokens without interactive login.
Session tokens
Application cookies or server session IDs for browsers.
SAML assertions
XML security tokens used in enterprise SSO.
Service credentials
Machine tokens from client-credentials or workload identity.
Token lifecycle
Issue after proof
Authorization server or app mints a token following authentication/consent.
Transmit safely
TLS only; prefer headers/cookies over URLs.
Validate on use
Signature/introspection, expiry, audience, and authorization claims.
Expire quickly
Short lifetimes limit replay after theft.
Revoke when needed
Logout, compromise, or privilege change invalidates active tokens.
Format and handling trade-offs
| Format | Upside | Caution |
|---|---|---|
| JWT (self-contained) | Local validation, scalable | Harder instant revoke without infra |
| Opaque token | Central revoke via introspection | Introspection latency/availability |
| Cookie session | HttpOnly reduces XSS token theft | CSRF controls required |
| SAML assertion | Rich enterprise claims | XML parser and validation complexity |
Hardening checklist
- Use the right token for the job—do not send ID tokens as API access tokens.
- Keep access token lifetimes short; protect refresh tokens aggressively.
- Validate issuer, audience, signature/introspection, and time claims every time.
- Never put tokens in URLs or logs.
- Prefer sender-constrained tokens for high-value APIs.
- Rotate signing keys and document JWKS handling.
- Invalidate sessions/tokens on password or MFA changes.
- Monitor anomalous token use across geography and clients.
The practical takeaway
A security token is portable proof of authentication or authorization. Its safety depends less on the buzzword and more on lifetime, binding, storage, and validation discipline.
Issue narrowly, transmit carefully, validate strictly, expire quickly, and revoke decisively.
Related security terms
Bearer Token
Common security token usage model based on possession.
ID Token
OIDC security token asserting user authentication.
Security Assertion
Signed identity statement often encoded as or carried by tokens.
JWT (JSON Web Token)
Popular format for many modern security tokens.
Token Revocation
Process for invalidating security tokens before expiry.
Frequently asked questions
What is a security token in simple terms?
It is a digital pass your app shows to prove you already logged in or were granted permissions—so you do not resend your password on every request.
Are all security tokens JWTs?
No. Tokens may be JWTs, opaque random strings, SAML XML, or other formats. JWT is common but not universal.
What is the difference between access and ID tokens?
Access tokens authorize API calls. ID tokens tell a client who authenticated. Mixing them is a frequent design error.
What is a session token?
An application-specific credential—often a cookie—representing a logged-in browser session after authentication completes.
Why are security tokens sensitive?
Whoever possesses a bearer token can usually act as the subject until expiry or revocation.
How should APIs validate tokens?
Verify signature or introspection result, issuer, audience, expiry, and scopes/claims required for the operation.
How do hardware ‘security tokens’ fit?
Physical OTP/FIDO devices are authenticators. This glossary page focuses on digital security tokens used in protocols and sessions—related but different meanings of ‘token’.
References
Explore authoritative guidance and frameworks related to security token.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.