GrantToken

GrantToken is a type of authorization credential used in access control systems to represent a granted permission to access a resource or perform an action. Unlike a user identity token, which asserts who a subject is, a grantToken encodes what the subject is allowed to do. It is issued by an authorization server after a successful authorization request and is presented to a resource server to validate the granted access.

Typically a grantToken carries claims such as allowed scopes, target resource identifiers, and an expiration time. It may be a JSON Web Token (JWT) with a digital signature or an opaque token that requires introspection by the issuer. When used as a JWT, the resource server can validate the signature and extract the permitted actions without contacting the issuer for each request; opaque tokens rely on token introspection endpoints.

Lifecycle: grantTokens are usually short-lived and can be renewed or exchanged for another token via a separate grant flow. They can be revoked by the authorization server before expiration in response to detected abuse, user revocation, or policy changes. Revocation requires robust tracking and timely propagation to resource servers.

Security and best practices: protect grantTokens in transit and at rest, prefer HTTPS and secure storage, minimize the scope and lifetime, bind tokens to the client or user to prevent token leakage, rotate and log token usage, and implement revocation and token introspection as needed. Ensure proper audience and issuer validation to prevent token misuse.

See also: access token, refresh token, OAuth 2.0, JWT.