TL;DR
Access tokens are compact, server-issued credentials that carry user identity, permissions, and expiration data in a single encoded package. They power everyday authentication flows — from standard login sessions to single sign-on (SSO) across multiple platforms. Because they travel over the internet, protecting them with encryption and short expiration windows is essential to preventing unauthorized access.
What is an access token?
An access token is a tiny piece of code that contains a large amount of data. Information about the user, permissions, groups, and timeframes is embedded within one token that passes from a server to a user's device.
Plenty of websites use access tokens. For example, if you've ever used credentials from one website (like Facebook) to gain entry to another website (like Salesforce), you've used an access token.
What's included in an access token?
A typical access token holds three distinct parts, all working together to verify a user's right to access a resource.
Three key elements are included in most access tokens.
- Header: Data about the token's type and the algorithm used to make it are included here.
- Payload: Information about the user, including permissions and expirations, is included here.
- Signature: Verification data, so the recipient can ensure the authenticity of the token, is included here. This signature is typically hashed, so it's difficult to hack and replicate.
The payload, also called the claims section, is critical to the success of the token. If you want to visit a specific resource on the server, but you're not given proper permissions within the payload, you won't gain access.
Developers can place all sorts of custom data within the payload too. For example, an access token from Google can grant access to multiple applications (Application Programming Interfaces, or APIs), and all of those credentials are specified with just one access token.
Access token types can vary from website to website. Facebook, for example, offers four access token types. Other sites have dozens more.
But no matter how much data is included, access tokens tend to be short. A JSON Web Token (JWT), for example, is made up of three Base64-URL strings. It's shorter than this paragraph.
How do access tokens work?
Users don't write their own access codes. Servers communicate with devices, and all the work happens in minutes.
You'll follow a predictable set of steps.
- Login: Use a known username and password to prove your identity.
- Verification: The server authenticates the data and issues a token.
- Storage: The token is sent to your browser for storage.
- Communication: Each time you access something new on the server, your token is verified once more.
- Deletion: When your session is over, the token is discarded.
You can also use access tokens for single sign-on (SSO). Your credentials from one site become your key to enter another. You'll follow these steps:
- Authorization: You agree to use your credentials from one site to enter another.
- Connection: The first site connects the second and asks for help. The second site creates an access token.
- Storage: The access token is stored in your browser.
- Entry: The access token from the second site gives you entry into the first.
Requests for SSO expire quickly. As we've explained elsewhere, most requests expire within about 10 minutes, but some shut down the process after just 60 seconds.
How can you protect the security of access tokens?
Access tokens should be protected as they move through the open space of the internet.
Why do access tokens need encryption?
Companies that don't use encryption or protected communication channels could allow third parties to grab tokens, and that could mean unauthorized access to very sensitive data. It pays to be very careful.
How does token expiration reduce security risks?
Most access tokens also expire. That simple step allows websites to ensure users are still online and active, and that could help to avoid large-scale duplication or deletion. Expiration dates can vary from company to company.
At Okta, we use robust systems to protect data at rest and in transit. We can help you understand what steps you must take to keep hackers away. And with our tools, you can encrypt data easily and quickly. Contact us to find out more.
Frequently asked questions
What information is stored inside an access token?
An access token typically contains three parts: a header with the token type and algorithm, a payload with user permissions and expiration details, and a cryptographic signature to verify authenticity. Developers can also embed custom data in the payload.
How long does an access token last before it expires?
Expiration windows vary by platform and use case. For single sign-on (SSO) authorization requests, most expire within about 10 minutes, while some platforms terminate the process after as little as 60 seconds. Standard session tokens have expiration policies set by each individual company.
What happens if an access token is intercepted?
If a token is captured by a third party during transmission. For example, over an unencrypted channel, it could grant unauthorized access to sensitive data. This is why encryption and protected communication channels are critical when transmitting tokens.
What is the difference between a standard login token and a single sign-on token?
A standard login token is issued after you authenticate directly with a server and is used to verify your identity on subsequent requests within that session. An SSO token, by contrast, is created by a second site and passed to a first site, allowing your credentials from one platform to grant entry to another without a separate login.
What is a JSON Web Token (JWT) and how does it relate to access tokens?
A JSON Web Token (JWT) is a compact, widely used format for access tokens. It is composed of three Base64-URL encoded strings representing the header, payload, and signature — making it short enough to transmit efficiently while still carrying all necessary authentication data.
Can one access token grant access to multiple applications?
Yes. Some platforms, such as Google, issue access tokens that can authorize access to multiple Application Programming Interfaces (APIs) simultaneously, with all relevant credentials encoded within a single token.
References
Using OAuth 2.0 to Access Google APIs. (December 2020). Google Identity.
Access Tokens. Facebook for Developers.
What Is OAuth? How the Open Authorization Framework Works. (September 2019). CSO.
