Access Token

What is an access token?

An access token is a credential that an OAuth 2.0 client presents to an API to reach protected resources, and it represents a specific authorization: which scopes were granted, to which client, for how long. The authorization server issues it after a user or an administrator consents. The token can be an opaque string or a JSON Web Token, and it is usually short-lived.

Key takeaways

• An access token represents an authorization issued to a client application, limited to specific scopes and a specific duration of access.
• An access token is meant for the API that holds the resources, while an OpenID Connect ID token only tells the client who signed in.
• The scopes in an access token set what a third-party app may do, within the reach of the approving account, whatever that user's job title.
• An access token usually expires quickly, so a client that needs lasting access holds a refresh token to request new access tokens.

How an access token works

• Consent: the user, or an administrator for the whole organization, approves the scopes a client application requests, such as reading calendars or sending email.
• Issuance: the authorization server returns an access token to the client, together with its lifetime and the scopes actually granted.
• Presentation: the client sends the token with each API call, in most cases in the Authorization header with the Bearer scheme defined by RFC 6750.
• Validation: the API checks the token, either by verifying a JWT's signature, issuer, audience and expiry locally, or by asking the authorization server about an opaque token.
• Expiry: once the token has expired, the API rejects it and the client has to obtain a new one.

Access token vs ID token: which one should reach the API?

OpenID Connect adds an ID token to the OAuth flow, and the two are often confused because both can be JWTs. The ID token is addressed to the client application: it proves who signed in and when, so the app can open a session. The access token is addressed to the API: it carries the authorization, not the identity. Sending an ID token to an API, or parsing an access token the client should treat as opaque, are classic integration mistakes.

RFC 6749, published in October 2012, describes access tokens as credentials that represent specific scopes and durations of access. For governance, that is the useful definition: the permission a third-party app holds is the set of scopes in its token. A junior employee can grant read access to an entire mailbox and drive, and an administrator can grant scopes that cover the whole organization.

Examples and use cases

A 300-person consultancy runs on Google Workspace. A sales manager signs in to an AI note-taking tool with her Google account and approves its request to read and manage her calendar and her email. The tool now holds access tokens with those scopes and calls the Google APIs on her behalf. Her title and team play no part: the scopes decide what the tool can read.

Corma's SaaS discovery brings tools like this one into the inventory, with their users and owner, as part of its shadow IT and shadow AI visibility. Access reviews then ask the owner of each app to confirm who should keep access, while the scopes themselves are checked and withdrawn in the Google Workspace admin console.

Related concepts

• OAuth 2.0
• JSON Web Token (JWT)
• OpenID Connect (OIDC)
• Single sign-on (SSO)
• Secrets management
• Corma identity and access management platform

FAQ

Is an access token the same as an API key?

No. An authorization server issues an access token for specific scopes and a limited time. An API key is a static secret, created once and valid until someone revokes it.

How long does an access token last?

The authorization server sets the lifetime when it issues the token. Access tokens are usually short-lived, and the client gets new ones with a refresh token.

Is an access token a JWT?

Sometimes. Many authorization servers issue access tokens as JWTs, others issue opaque strings that only the server can interpret.

Can an access token be revoked?

Yes, if the authorization server supports revocation and the API checks it. A self-contained JWT usually stays valid until it expires, which is one reason access tokens are short-lived.

Request a demo