Access Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes measured in minutes. Treat them as bearer secrets: anyone holding the token can use it.
Because most access tokens are bearer tokens, possession is authorization: anyone holding one can use it until it expires. That is why token theft from browser sessions and infostealer logs has displaced password phishing as the dominant account-takeover path, and why a password reset does nothing to contain it. Short lifetimes limit the window; sender-constraining with DPoP or mTLS closes it by binding the token to a key the thief does not have.
See also: OAuth 2.0, refresh token, DPoP, token theft
Related on Start with Identity
- GlossaryID Token
A JWT issued by an OpenID Connect provider that conveys authentication claims about the user. Unlike access tokens, ID tokens are intended for the client, not f
- GlossaryOpenID Connect (OIDC)
OpenID Connect is an authentication layer built on top of OAuth 2.0. Where OAuth tells you what a token is authorized for, OIDC tells you who the user is via a
- CVEWordPress OAuth SSO plugin JWT bypass, admin takeover
The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVESharePoint JWT validation chain, forge a token and become any user
Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026