Access Token

Overview

Access Token is a credential presented by a client to access protected resources with the permissions granted by an authorization system. It is used to authorize API calls without repeatedly exposing a user’s primary credentials. It differs from an API key, which often identifies an application and may not represent a delegated user or scoped authorization grant.

A typical implementation works as follows: The client obtains a token through an approved flow, sends it in the Authorization header, and refreshes or replaces it according to its lifetime. Monitoring for Access Token should track failed use, unusual scope or audience, expiry, rotation status, and attempts involving revoked credentials.

Common risks include token leakage and excessive scope. Important failure modes include token leakage, excessive scope, insecure storage, replay, logging, and weak audience validation. These failures can enable unauthorized API use.

Core controls require teams to use short lifetimes, least-privilege scopes, TLS, audience and issuer checks, secure storage, rotation, and immediate revocation after compromise. The Access Token boundary should identify the principal, credential or key, permitted audience, scope, lifetime, and revocation path.

Operational evidence should include token identifier or hash, issuer, audience, subject, scopes, issued and expiry times, client, and revocation state. Access Token should be documented alongside API Key Rotation, API Client, and Certificate Pinning.

The Access Token recovery process should restore access without bypassing the original identity and authorization controls. Least-privilege configuration for Access Token should be verified against the operations used by each environment and consuming service. A compromise response for Access Token should support rapid revocation, replacement, affected-client identification, and review of prior use.