--- title: "Access Token — Identity Glossary | IDSync" description: "An access token is a short-lived credential issued by an OAuth 2.0 authorization server that a client presents to a resource server (API) to prove it has…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Access Token", "item": "https://idsync.com/glossary/access-token" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/access-token", "name": "Access Token", "alternateName": [ "Access Token", "Bearer Token" ], "description": "An access token is a short-lived credential issued by an OAuth 2.0 authorization server that a client presents to a resource server (API) to prove it has been authorized to act on behalf of a user or workload, within a specific scope.", "url": "https://idsync.com/glossary/access-token", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Access Token Standards # Access Token An access token is a short-lived credential issued by an OAuth 2.0 authorization server that a client presents to a resource server (API) to prove it has been authorized to act on behalf of a user or workload, within a specific scope. Last reviewed 3 months ago Key points - Access tokens are typically JWTs but can be opaque (introspected via RFC 7662). - Short-lived by design — minutes to a single-digit hour. Long-lived access tokens are an anti-pattern. - Bearer semantics: whoever holds the token can use it. Bind them to clients with DPoP or mTLS for sensitive APIs. - Scopes (read:invoices, write:profile) limit what an access token can do — request the minimum your app needs. - Pair with refresh tokens to renew without re-prompting the user; pair with token introspection or short TTLs for revocability. ## What is an access token? An **access token** is the credential an OAuth 2.0 client presents to an API to prove it's been authorized to act. It's the answer to _"what can this caller do, and for whom, right now?"_ Two main shapes: - **Self-contained JWT** — the API can verify it locally using the issuer's public keys, no network call needed. Fast, scalable. - **Opaque token** — a random string; the API must call the authorization server's introspection endpoint (RFC 7662) to learn what it represents. Slower but easier to revoke instantly. ## What's typically inside For a JWT access token: - `iss` — the authorization server that issued it - `sub` — the resource owner (user) or client (for client\_credentials) - `aud` — the API it's intended for - `exp` / `iat` — expiry and issued-at - `scope` — space-separated OAuth scopes - `client_id` — which OAuth client got it - Custom claims (tenant, roles, permissions) ## When buyers care - **API security review** — token TTL, revocation strategy, scope granularity all show up in pen tests and audits. - **Token theft incidents** — see Microsoft midnight blizzard, GitHub OAuth app compromise. Short TTLs + sender-constrained tokens (DPoP, mTLS) limit blast radius. - **B2B SaaS integrations** — partners need scoped, revocable access. Long-lived API keys are the legacy alternative; OAuth + scoped access tokens are the modern one. ## Common misconceptions - **"Access tokens are for the user."** No — they're for the API. The user's identity is in the ID token (OIDC). Use the right token for the right purpose. - **"Longer TTLs are more user-friendly."** Use refresh tokens instead. Long-lived access tokens are revocation nightmares. - \*\*"Scopes don't matter, just grant `.*`."\*\* Scopes are how you prove least privilege in audits. ## Editorial note Treat access tokens like cash: short-lived, narrowly scoped, easy to invalidate. If your design has a multi-day access token in env vars, you've built a static API key in a JWT costume. ## Standards & references - [RFC 6749 §1.4 — Access Token](https://datatracker.ietf.org/doc/html/rfc6749#section-1.4) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [authorization](/directory/category/authorization)[api security](/directory/category/api-security) ### Related terms [oauth 2](/glossary/oauth-2)[openid connect](/glossary/openid-connect)[jwt](/glossary/jwt)[refresh token](/glossary/refresh-token) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the authorization category. [Explore tools](/directory/category/authorization) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.