LDAPWiki: Access Token

Overview#

Access Token is a token that is involved in Access

OAuth 2.0 Access Token#

In OAuth 2.0, Access Token is a Token issued to the OAuth Client by the Authorization Server.

Access Token is used as a credential for the OAuth Client when attempting access to a Resource Server

The Resource Owner involved in authorization decision and grants Permissions (via OAuth Scopes).

Access Token has a Expiration Date, Usually Time limited, but large time.
Access Token MAY be revoked by Resource Owner actions
Access Token Contains Authorized via OAuth Scopes
Access Token in OAuth 2.0 the Access Token Type is MAY NOT be specified and then it is a Bearer Token).

The OAuth 2.0 Audience Information add an additional "audience" parameter to the Access Token

You maybe wondering Why Access Tokens?

Contents#

Access Token in OAuth 2.0 the type is not specified other than that the Access Token is a Bearer Token.

Access Token is returned from an in an Authorization Response as:

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache
{
    "access_token":"mF_9.B5f-4.1JqM",
    "token_type":"Bearer",
    "expires_in":3600,
    "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA"
}

Access Token in OpenID Connect is specified as a JSON Web Tokens the type (typ) is specified in the Access Token

{
  "alg": "RS256",
  "typ": "JWT"
}
.
{
  "iss": "https://example.auth0.com/",
  "aud": "https://api.example.com/calandar/v1/",
  "sub": "usr_123",
  "scope": "read write",
  "iat": 1458785796,
  "exp": 1458872196
}

Access Token Validation describes how Validation SHOULD be performed.