What is Access Token?
An access token is a credential that a client presents to a resource server. It represents an authorization issued to the client, usually with a defined scope and lifetime. It does not prove that the current holder is the original user. Send bearer tokens in the Authorization header over TLS. Do not put bearer tokens in URLs because logs and browser history can expose them.
Why it matters
An access token lets a client call a resource without sending the user's primary credentials. Its audience, scope, lifetime, storage, and transport determine how much harm follows a leak.
How it works
- A client completes an authorization grant with an authorization server.
- The authorization server issues a token for a defined resource, scope, and lifetime.
- The client sends the token to the resource server, which validates it before it authorizes the requested operation.
Example
A command-line client receives a short-lived token for the metrics API with read scope. It sends the token in the Authorization header when it reads one metrics endpoint.
Pomerium boundary
Pomerium can receive bearer tokens on protected HTTP routes. In the default mode, it passes the bearer token to the upstream service without interpreting it. With idp_access_token or idp_identity_token, Pomerium interprets the token as an IdP-issued token and creates a Pomerium session. The selected mode determines whether Pomerium or the upstream service interprets the presented token.
Limits and non-claims
- A bearer token can be used by any party that obtains it until it expires or is revoked.
- A token scope does not by itself prove the identity of the current human user.
- Revocation behavior depends on the token format, authorization server, resource server, and cache design.
Evaluation checklist
- Does the resource server validate issuer, audience, subject, scope, time, and token type?
- Is the token a bearer credential or sender-constrained, and where can it leak?
- Does the target authorize the exact resource and action after token validation?
