Tilgangstoken

Tilgangstoken, often translated as access token, is a credential used in authentication and authorization protocols, most notably OAuth 2.0. Its primary purpose is to grant a client application permission to access specific resources on behalf of a user without exposing the user's primary credentials, such as a username and password. When a user authorizes an application to access their data, the authorization server issues an access token to that application.

This token typically contains information about the client, the user, the scope of permissions granted, and an expiration time. The client then presents this access token to the resource server whenever it needs to access protected resources. The resource server validates the token, often by checking its signature and expiration, and if valid, grants access according to the permissions encoded within it.

Access tokens are designed to be short-lived to minimize the security risk if a token is compromised. Once an access token expires, the client usually needs to obtain a new one, often by using a refresh token, which is a longer-lived credential used specifically to acquire new access tokens. The use of access tokens is a fundamental mechanism for secure delegated access in modern web and mobile applications.