What is an access token?

Access token is a set of credentials represented by a string of characters that grants a user or application access rights to protected resources. It is issued by the authorization server after successful authentication and authorization of the user.

Key characteristics:

• Temporary: They have a limited lifespan and become invalid after expiration.
• Opaque: The token's content is often not understandable to the client and is intended only for the resource server.
• Unique: Generated for each access request.
• Revocable: The authorization server can revoke the token before its expiration (e.g., if the user changes their password).

Example of usage in an HTTP request (most often in the Authorization header):

GET /api/resource  
Host: example.com  
Authorization: Bearer your_access_token