Access Token
A temporary credential (JWT or opaque token) that allows an application to access specific APIs or resources.
What is Access Token?
Access Token is a credential that represents the authorization granted to a client application to access protected resources on behalf of a user. Access tokens are issued by an authorization server (after the user authenticates and grants consent) and are presented to resource servers (APIs) to gain access.
Access tokens come in two main formats:
- JWT (JSON Web Token): Self-contained token with encoded claims (sub, scope, exp)
- Opaque Token: Random string that requires introspection endpoint lookup
Access tokens have limited lifetime (typically 15-60 minutes) and limited scope (only the permissions the user granted). After expiration, a refresh token can be used to obtain a new access token.
Analogy
Think of an access token like a valet parking ticket. The valet (app) gets a ticket (token) that lets them drive your car (access resources) for a limited time, but they can't access your trunk or glove box (other resources) and the ticket expires after a few hours.
Types and Use Cases
- API Authentication: Include access token in Authorization header to call protected APIs
- Mobile Apps: Use access tokens to authenticate API requests from mobile clients
- Single Page Apps (SPAs): Store access tokens in memory for stateless API access
- Microservices: Pass access tokens between services for user-context propagation
How it Works
// Access Token Request (OAuth 2.0 Authorization Code Flow)
POST /oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code&
code=auth_code_from_redirect&
redirect_uri=https://app.example.com/callback&
client_id=1234567890&
client_secret=client_secret_here
// Response
{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "def502003d...",
"scope": "read write"
}
// Using Access Token
GET /api/user/profile
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...Access Token vs Refresh Token
Access Token
Refresh Token
Access Token is used to access resources (short-lived, 15-60 min)
Refresh Token is used to get new access tokens (long-lived, days/months)
Access tokens have limited scope (only granted permissions)
Refresh tokens have broader privileges (can get any scope)
Access tokens are sent with every API request
Refresh tokens are only sent once to exchange for new access token
Best Practices for Access Token
- Short expiration times: Set access token expiry to 15-60 minutes to limit blast radius if stolen
- Use HTTPS only: Access tokens are bearer tokens - anyone with the token can use it (like cash)
- Store securely: Don't store access tokens in localStorage (XSS risk) - use httpOnly cookies or memory
How LoginRadius Powers Access Token
LoginRadius CIAM platform provides flexible access token management through OAuth 2.0 and OpenID Connect standards. We issue both JWT and opaque access tokens with configurable expiration times, scopes, and custom claims. LoginRadius supports authorization code flow with PKCE (for SPAs/mobile), client credentials flow (for machine-to-machine), and refresh token rotation for enhanced security. Our platform also provides token introspection endpoints, revocation APIs, and detailed token usage analytics.
FAQs
If an access token is stolen: (1) Attacker can use it until it expires (15-60 minutes typically), (2) Rotate tokens - implement token rotation so stolen tokens are instantly invalidated, (3) Detect unusual use - monitor for impossible travel, bulk data access, (4) Use short expiry - 15-60 minutes limits the damage window. Since access tokens are 'bearer tokens', anyone holding the token can use it - there's no additional verification.
JWTs are self-contained (no database lookup needed) and easier to debug, but opaque tokens are more secure (cannot be decoded by client, must be introspected server-side). For high-security scenarios, use opaque tokens with introspection endpoint. For microservices/stateless architectures, use JWTs. LoginRadius supports both formats - configure based on your security vs. performance needs.
LoginRadius issues access tokens via OAuth 2.0 and OpenID Connect flows. Our platform supports both JWT access tokens (self-contained, stateless) and opaque tokens (random strings with introspection). LoginRadius allows you to configure token expiration (15-60 minutes recommended), customize token claims (add custom fields), and implement token rotation for enhanced security. We also provide refresh token flows for seamless session renewal.