OAuthtoken

An OAuthtoken, commonly referred to as an OAuth token or access token, is a credential issued by an OAuth 2.0 authorization server that grants a client application permission to access protected resources on a resource server on behalf of a resource owner.

There are several token types in OAuth-based systems. An access token is used to authorize API requests; a refresh token can be exchanged for a new access token when the current one expires; and in OpenID Connect, an ID token conveys authentication information about the user.

Token formats vary. Tokens can be opaque strings that require the authorization server to validate them, or self-contained JSON Web Tokens that carry claims and can be validated by the resource server. Bearer tokens are presented by clients in HTTP Authorization headers as "Bearer <token>".

Tokens are issued through flows such as the authorization code flow, client credentials flow, or resource owner password credentials flow. After the user consents, the authorization server issues tokens to the client, which then uses the access token to access protected endpoints. Resource servers validate the token, typically by checking signature, issuer, audience, and expiry.

Security considerations include protecting tokens in transit with TLS, securing token storage on clients, using short lifetimes and rotation, using PKCE for public clients, and implementing token revocation and introspection as needed to mitigate leakage.

Standardization and related concepts: OAuth 2.0 (RFC 6749), Bearer Token usage (RFC 6750), JWT-based tokens (RFC 7519), token introspection (RFC 7662), and OpenID Connect for ID tokens.

In practice, OAuth tokens are used to authorize access to APIs, cloud services, and microservices, and their management is a key part of identity and access management systems.