Tokens and credentials
Access token
A credential presented to an API to prove the caller is authorized, typically short-lived.
What Access token means
An access token authorizes a call to an API. By default it is a bearer token, meaning anyone holding it can use it — there is nothing inside a plain bearer token binding it to the client it was issued to. Short lifetimes limit the damage from theft; they do not prevent it.
Defined in: RFC 6749 §1.4; JWT profile in RFC 9068; sender-constraining in RFC 9449.
How it works
Access tokens come in two shapes. A JWT access token carries its claims inside itself, so a resource server can validate it locally without calling the provider — fast, and it means revocation cannot take effect until expiry. An opaque token carries nothing and must be introspected at the provider, which costs a network call and allows immediate revocation. The choice is a genuine trade between latency and control, not a matter of taste.
Lifetimes are the usual compensating control: minutes rather than hours, with a refresh token obtaining new ones. That narrows the window in which a stolen token is useful, and narrowing is all it does.
Sender-constraining removes the bearer property. DPoP binds a token to a key the client holds, so presenting the token without proving possession of that key fails. This is the meaningful defence against token theft rather than a mitigation of it.
The mistake people actually make
Storing access tokens in `localStorage` in a browser application. Any script on the page can read them, which makes every third-party script and every XSS a token-exfiltration path.
Guides that go deeper
- OAuth and OpenID Connect for single-page apps: where tokens should live
- Refresh token rotation and reuse detection, explained
- DPoP implementation guide: sender-constrained tokens without mTLS
- OAuth token exchange (RFC 8693) for delegation and impersonation
- Service-to-service authentication with the client credentials grant
- How to validate a JWT access token in your API
Related terms
OAuth 2.0
An authorization framework that lets an application obtain limited access to a resource without handling the user's credentials.
DPoP
Demonstrating Proof of Possession — binds a token to a key the client holds, so a stolen token alone is useless.
Refresh token
A long-lived credential used to obtain new access tokens without the user re-authenticating.
ID token
A signed JWT from an OpenID Connect provider carrying verifiable claims about the authenticated user.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.