A credential that represents the authorization granted to a user or application to access resources on a server.
Description
In the context of Single Sign-On (SSO) protocols, an access token is a key component that facilitates authenticated access to various applications without requiring multiple logins. When a user signs in through an SSO system, an access token is generated and issued to the user. This token contains information about the user's identity and the permissions granted to them. It is typically a short-lived credential that allows the user to access specific resources or APIs on behalf of the user. For example, when a user logs into Google, an access token is created that allows them to access services like Gmail, Google Drive, and YouTube without needing to log in separately to each service. Access tokens are usually transmitted in HTTP headers during API calls, ensuring secure communication. They enhance user experience by providing seamless access across multiple platforms while maintaining security and control over user permissions.
Examples
- An access token generated by OAuth2 when a user logs into a web application like Slack using their Google account.
- A token issued by Microsoft Azure Active Directory that enables access to Office 365 services after a successful SSO login.
Additional Information
- Access tokens are usually time-limited, reducing the risk if a token gets compromised.
- They can be revoked by the authorization server, allowing administrators to manage user access effectively.