Access Token
An access token is a credential an app sends to a protected service to show what it may do. Rules usually limit who issued it, which service accepts it, its permissions, and its lifetime.
Another example
A calendar app has a bearer token for calendar.read. Its audience is api.calendar.example, and it lasts 10 minutes. The API checks it and allows only reading before expiry. Holding it grants access but does not prove a person's identity. A refresh token has a different job.
Main parts
- 01authorization grant
- 02scope and audience
- 03expiry and validation
Use it when
Use this term for the credential an app gives an API under a clear authorization grant.
Do not use it when
Do not use access token as another name for a password, session ID, ID token, API key, or refresh token.
Name used in code
Authorization: Bearer <token> Before you ship
Check contracts and invariants, authorization, and input limits. Test retries, one-time effects, timeouts, and partial failures. Verify data integrity, compatibility, monitoring, recovery, and rollback.
Outcome: Design or review Access Token for this system while keeping data correct, secure, and easy to operate. User context: A calendar app has a bearer token for calendar.read. Its audience is api.calendar.example, and it lasts 10 minutes. The API checks it and allows only reading before expiry. Holding it grants access but does not prove a person's identity. A refresh token has a different job. Technical concept or control: Access Token. Why it fits: Use this term for the credential an app gives an API under a clear authorization grant. Do not use it when: Do not use access token as another name for a password, session ID, ID token, API key, or refresh token. Engineering requirements: Define inputs, outputs, contracts, and rules that must always hold. Set authorization and input checks. Define failures, timeouts, retries, one-time effects, data moves, and compatibility limits. Operations: Add useful signals and logs that hide sensitive data. Set capacity limits and write an operator guide. Test recovery and rollback. Acceptance criteria: Contract and failure-path tests pass. Data and authorization rules still hold during retries and partial failures. Check performance limits, monitoring, recovery, and rollback. Evidence and limits (evidence boundary): The standard covers only the listed scope. It does not choose the visual style, product decision, or Vibulary example. Unknowns to confirm: Where the code runs, data stores, traffic shape, consistency needs, and the security boundary. Also confirm the compatibility period, service goals, and rollback limits.
Check this request
Review the current use of Access Token. Definition: An access token is a credential an app sends to a protected service to show what it may do. Rules usually limit who issued it, which service accepts it, its permissions, and its lifetime. Release checks: Check contracts and invariants, authorization, and input limits. Test retries, one-time effects, timeouts, and partial failures. Verify data integrity, compatibility, monitoring, recovery, and rollback. Before changing code, report the evidence you found, gaps, severity, and the smallest safe fix.