What Is Token-Based Authentication?

TL;DR

Token-based authentication replaces repeated password entry with a time-limited access token issued after a one-time verification. Tokens come in three physical forms—connected, contactless, and disconnected—and can be implemented in four steps. JSON Web Tokens (JWTs) are a popular open-standard variant suited for mobile and web apps, offering compact size and granular access control, though they carry risks if cryptographic keys are mismanaged. Following best practices—keeping tokens private, encrypted, tested, and appropriately matched to the use case—is essential for a secure implementation.

What is token-based authentication?

Token-based authentication is a protocol which allows users to verify their identity, and in return receive a unique access token. During the life of the token, users then access the website or app that the token has been issued for, rather than having to re-enter credentials each time they go back to the same webpage, app, or any resource protected with that same token.

Auth tokens work like a stamped ticket. The user retains access as long as the token remains valid. Once the user logs out or quits an app, the token is invalidated.

Token-based authentication is different from traditional password-based or server-based authentication techniques. Tokens offer a second layer of security, and administrators have detailed control over each action and transaction.

But using tokens requires a bit of coding know-how. Most developers pick up the techniques quickly, but there is a learning curve.

Let's dig in, so you can determine if tokens are right for you and your organization. 

How did authentication tokens come about?

Authentication and authorization are different but related concepts. Before we had authentication tokens, we had passwords and servers. We used traditional methods to ensure that the right people had access to the right things at the right time. It wasn't always effective.

Consider passwords. Typically, they involve:

• User generation. Someone comes up with a combination of letters, numbers, and symbols.
• Memory. The person must keep that unique combination in their mind.
• Repetition. Whenever the user needs to access something, the password has to be entered.

Password theft is common. In fact, one of the first documented cases of password theft happened all the way back in 1962. People can't remember all of their passwords, so they resort to tricks, such as:

• Writing them all down. Loose pieces of paper filled with passwords are security nightmares.
• Repeating them. People tend to use the same password in multiple places. If one password is discovered, many accounts may be vulnerable.
• Slightly changing them. People change one letter or number when prompted to update a password.

Passwords also require server authentication. Each time the person logs on, the computer creates a record of the transaction. Memory load increases accordingly.

How does token authentication differ from passwords?

Token authentication is different.

With token authentication, a secondary service verifies a server request. When verification is complete, the server issues a token and responds to the request.

The user may still have one password to remember, but the token offers another form of access that's much harder to steal or overcome. And the session's record takes up no space on the server. 

What are the different types of authentication tokens?

All authentication tokens allow access, but each type works a little differently.

These are three common types of authentication tokens:

• Connected: Keys, discs, drives, and other physical items plug into the system for access. If you've ever used a Universal Serial Bus (USB) device or smartcard to log into a system, you've used a connected token.
• Contactless: A device is close enough to a server to communicate with it, but it doesn't plug in. Microsoft's so-called "magic ring" would be an example of this type of token.
• Disconnected: A device can communicate with the server across long distances, even if it never touches another device at all. If you've ever used your phone for a two-factor authentication process, you've used this type of token.

In all three of these scenarios, a user must do something to start the process. They may need to enter a password or answer a question. But even when they complete those preliminary steps perfectly, they can't gain access without the help of an access token. 

How does token authentication work?

Use a token-based authentication system, and visitors will verify credentials just once. In return, they'll get a token that allows access for a time period you define.

The process works like this:

1. Request: The person asks for access to a server or protected resource. That could involve a login with a password, or it could involve some other process you specify.
2. Verification: The server determines that the person should have access. That could involve checking the password against the username, or it could involve another process you specify.
3. Tokens: The server communicates with the authentication device, like a ring, key, phone, or similar device. After verification, the server issues a token and passes it to the user.
4. Storage: The token sits within the user's browser while work continues.

How are token sessions managed and expired?

If the user attempts to visit a different part of the server, the token communicates with the server again. Access is granted or denied based on the token.

Administrators set limits on tokens. You could allow a one-use token that is immediately destroyed when the person logs out. Or you could set the token to self-destruct at the end of a specified time period.

What is a JSON Web Token (JWT)?

Because so many users are accessing systems via mobile phones (apps) and web apps nowadays, developers need a secure way to authenticate that's appropriate for those platforms.

To solve that challenge, many developers turn to JSON Web Tokens (JWTs) when working on tokens for their applications.

A JSON web token (JWT) is an open standard. The finished product allows for safe, secure communication between two parties. Data is verified with a digital signature, and if it's sent via Hypertext Transfer Protocol (HTTP), encryption keeps the data secure.
 

What are the three components of a JWT?

JWTs have three important components.

1. Header: Define token type and the signing algorithm involved in this space.
2. Payload: Define the token issuer, the expiration of the token, and more in this section.
3. Signature: Verify that the message hasn't changed in transit with a secure signature.

Coding ties these pieces together. The finished product looks something like this.

How do you get started with JSON Web Tokens?

Don't be intimidated by JSON code. This type of notation is common when entities want to pass data back and forth, and tutorials abound. If you're interested in using JSON tokens but you've never tried the language before, a resource like this could be helpful.

What are the advantages and disadvantages of JWTs?

JWTs offer several benefits, but they also come with notable trade-offs worth considering.

Why should you try authorization tokens?

You've assessed your current strategy, and you think things are working just fine. Why should authorization tokens become part of your systems? Very real benefits come to developers who take the plunge.

Authorization tokens are good for administrators of systems that:

• Often grant temporary access. Your user base fluctuates based on the date, the time, or a special event. Granting and rescinding access repeatedly is too draining. Tokens could be helpful.

  Administrators of university library sites, for example, might appreciate a token approach.

• Require granular access. Your server grants access based on specific document properties, not user properties. Passwords don't allow that time of fine-tuned detail.

  For example, you run an online journal. You want everyone to read and comment on only one document, not on any others. Tokens could allow this.

• Are prime hacking targets. Your server contains sensitive documents that could do your company intense damage on release. A simple password doesn't offer enough protection. A piece of hardware helps quite a bit.

Many more authentication token use cases exist. But this quick list could get your creative juices flowing, and the more you think about the benefits, the more likely you might be to get on board. 

What are the best practices for authentication tokens?

Authentication tokens are meant to enhance your security protocols and keep your server safe. But they won't work effectively if you don't build your processes with safety in mind.

Your authentication tokens should be:

• Private. Users can't share token authentication devices or pass them around between departments. Just as they wouldn't share passwords, they shouldn't share any other part of your security system.
• Secure. Communication between the token and your server must be secure via Hypertext Transfer Protocol Secure (HTTPS) connections. Encryption is a critical part of keeping tokens safe.
• Tested. Run periodic token tests to ensure that your system is secure and functioning properly. If you spot a problem, fix it quickly.
• Appropriate. Pick the right token type for your individual use case. For example, JWTs aren't ideal for session tokens. They can be costly, and security risks involved with interception are impossible to eliminate. Ensure you're always picking the right tool for the job.

Don't take your authentication token decision lightly. Do your homework, ask your peers, and ensure that you're doing the best job you can for your company. 

Let Us Help

As we continue to evaluate how we secure access to our homes and offices, it's just as important to implement mechanisms like token-based authentication to ensure that only the right people have access to our digital resources.

Discover how Okta can better secure your world.

Frequently asked questions

What is the difference between token-based authentication and password-based authentication?

Password-based authentication requires users to enter credentials every time they access a resource, and those credentials are verified against a server record. Token-based authentication issues a time-limited token after a single verification, allowing users to access protected resources without re-entering credentials. Tokens also leave no session record on the server, reducing memory load.

How long does an authentication token remain valid?

Token validity is set by the administrator. A token can be configured for single use—invalidated immediately after the user logs out—or it can be set to expire after a defined time period. Once expired or invalidated, the user must re-authenticate to receive a new token.

What are the three types of authentication tokens?

Authentication tokens fall into three categories based on how they interact with a system: physical plug-in devices (connected), wireless proximity-based devices (contactless), and remote devices like smartphones used in two-factor authentication (disconnected).

When should you use a JSON Web Token (JWT) instead of another token type?

JWTs are well-suited for mobile apps and web applications because they are compact, can be generated from almost anywhere, and do not require server-side verification. However, they are not ideal for session tokens due to cost and interception risks. Developers should evaluate the specific use case before choosing JWTs over other token formats.

What are the biggest security risks associated with authentication tokens?

Key risks include relying on a single cryptographic key for JWTs (if compromised, the entire system is at risk), using insecure communication channels (tokens must be transmitted over HTTPS), and sharing tokens between users. Developers without strong knowledge of cryptographic algorithms may also inadvertently introduce vulnerabilities.

What best practices should organizations follow when implementing authentication tokens?

Tokens should be kept private and never shared between users. All communication between the token and server must use encrypted HTTPS connections. Organizations should run periodic tests to verify system integrity, and administrators should select the token type that best fits the specific use case—for example, avoiding JWTs for session management where simpler, lower-risk alternatives exist.

References

The World's First Computer Password? It Was Useless Too. (January 2012). Wired.

Microsoft Says This Magic Ring Could Make Passwords Obsolete. (June 2020). Small Business Trends.

JSON Web Token. (May 2015). Internet Engineering Task Force.

Working With JSON. Mozilla.

Security Token. Citi.

Security Token Definition. (June 2020). Investopedia.

Two-Factor Authentication. (February 2020). Explain That Stuff.

When Are Tokens Securities? Some Questions from the Perplexed. (December 2018). Harvard Law School Forum on Corporate Governance