An access token is a credential an application presents to an API to prove it has been granted specific, scoped access; it is typically short-lived.
Frequently asked questions
Why are access tokens short-lived?
Limiting the lifetime reduces the damage if a token is ever intercepted or leaked.
Can an access token be reused across different APIs?
Not securely; resource indicators (RFC 8707) restrict a token's audience to the specific resource it was issued for. See resource indicators.
Was this definition useful?
Feedback goes to the editor who maintains this entry.
.avif)