Access Token

ELI5 — The Vibe Check

An Access Token is your short-lived pass to access an API. It proves you're authenticated and what you're allowed to do. It expires quickly so if someone steals it, the damage is limited. It's your API's 'hello, I'm allowed to be here' badge.

Real Talk

Access tokens are short-lived credentials (typically JWTs) that authorize API requests. They contain identity claims, scopes/permissions, and expiration time. Sent in the Authorization header, they're verified by resource servers without contacting the auth server. Short expiry limits exploitation window if compromised.

When You'll Hear This

"Access tokens expire in 15 minutes — short enough to limit damage if stolen." / "The access token contains the user's scopes so the API knows what they can do."