A token is a security artifact that carries identity or authorization information between participants in an authentication or authorization protocol. An identity provider issues it after authentication, and an application or service presents it to prove permitted access. section 12.1 section 12.5
Common token roles include:
- Access tokens authorize requests to a resource server. section 12.5
- ID tokens carry user information in OpenID Connect flows. section 12.5
- Service tokens authenticate one application or service to another without user involvement. section 12.5 section 16.2.1
- Magic-link tokens authenticate a user through a short-lived, signed link. section 14.1
Tokens must have controlled lifetimes and validation rules. JWTs commonly contain metadata, user or client details, and a signature; validation uses cryptographic checks or token introspection. Short-lived and one-time tokens reduce replay risk, while storage enables invalidation and reuse detection. section 12.5 section 14.1
Service-to-service request
An order service authenticates with an identity provider using client credentials, receives a usually JWT-formatted token, attaches it to a billing-service request, and the receiving service validates its identity information. section 16.2.1
Figure 12.5 The user authenticates with the IdP, which issues a token. This token serves as proof of the user’s identity and successful authentication.
Visualizes the basic relationship between user authentication, identity-provider issuance, and a token serving as proof of identity. section 12.1
