Home / Knowledge hub / Access token
Knowledge hub
Access token
A short-lived token that lets a client call an API on a user's behalf.
What it means
An access token is a credential given to an app after a person signs in or approves access. The app attaches it to each API call, and the API accepts the call if the token is valid. OAuth 2.0 defines it as the thing that represents the granted permission.
The token usually says who it is for, what it may do (its scope) and when it stops working. It lets an app act for a user without ever seeing the user's password.
Why it matters
Whoever holds the token has the access it grants. If one leaks through a log file, a URL or a script on the page, the thief can call your API as that person until it expires. Short lifetimes and narrow scopes decide how much that is worth.
Your API also has to check each token properly. If it accepts expired tokens, ignores scope or trusts a token meant for a different service, a stolen or borrowed one reaches far more than it should.
How it shows up
You meet access tokens in OAuth and OpenID Connect flows, mobile apps, single-page apps and service-to-service calls. They travel as a bearer token in an Authorization header, and are often JWTs, though they can be opaque strings.
The mistakes repeat. Tokens that live for days. Tokens in URLs and logs. Scope never checked on the API side. No way to cancel one after a password change. Pair access tokens with a refresh token, and test what each endpoint does with someone else's.
Questions people ask
Access token, answered
What is the difference between an access token and a refresh token?
The access token is used on each API call and is short-lived. The refresh token is kept safer and used only to get a new access token.
This limits damage if an access token leaks.
How long should an access token last?
Minutes to an hour is typical. There is no single correct figure; it depends on how much harm a stolen token could do and how often users must renew.
Shorter is safer, but only if refresh is handled well.
Is an access token the same as a session cookie?
Similar purpose, different carrier. A cookie is sent automatically by the browser. An access token is added by code to API calls, usually in a header.
Both grant access to whoever holds them.
Where should a single-page app store one?
There is no perfect place. Local storage can be read by any script on the page, while cookies need CSRF defences.
OWASP guidance favours keeping tokens out of reach of page scripts where you can, for example in secure cookies.
How do we test our API's token handling?
Try expired tokens, tokens with the wrong scope, tokens for another tenant and no token at all against each endpoint.
A pentest should show which of those the API wrongly accepts.
Sources
Where this comes from
Related
Terms that sit next to this one
Bearer token
A token that works for whoever holds it, with no further proof of identity.
Refresh token
A long-lived token used to get new short-lived access tokens without signing in again.
OAuth
The standard behind every sign in with and connect your account button.
JWT
A signed token a client carries to prove who is signed in.
Token revocation
Cancelling a token before it expires, for example after a password change.
What can this token actually reach?
Tokens that outlive their purpose, ignored scopes and one account's token opening another's data fall inside cross-account access testing, and we report only what we exploited. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.