Understanding ID Token, Access Token, and Refresh Token in OpenID Connect (OIDC) - Datawiza (2024)

FAQs

What is ID token access token and refresh token? ›

ID Tokens, Access Tokens, and Refresh Tokens together enhance both security and user experiences in OIDC-enabled applications. While the ID Token confirms the user's identity, the Access Token governs access to server-protected resources, and the Refresh Token circumvents repeated manual user re-authentication.

OIDC is a simple identity layer built on top of OAuth 2.0 that provides authentication and identity assertion. The ID token is a security token that includes claims regarding the authentication of the user by the authorization server with the use of an OAuth client application.

Refresh tokens extend the lifespan of an access token. Typically, they're issued alongside access tokens, allowing additional access tokens to be granted when the live access token expires. They're usually stored securely on the authorization server itself.

An ID token contains the identity information about the authenticated users, and it is intended to be consumed by the front-end application. On the other hand, an access token represents a ticket with permission to consume an API.

The reason we need a short-lived access token and a long-lived refresh token, rather than a long-lived access token, is specifically because of the necessity of a blacklist. We need a way to invalidate an access token that, by its nature, cannot be invalidated.

@bsrour You don't “decode” a refresh token. Refresh tokens are just strings. You use refresh tokens to extend the lifetime of an OAuth access token. If either the access token or refresh token have expired, then the user will need to authorise your application again.

Once a user logs in, use the ID token to gather information such as name and email address, which you can then use to auto-generate and send a personalized welcome email. ID Tokens should never be used to obtain direct access to APIs or to make authorization decisions.

The access token is used to authenticate API requests to access protected resources, while the refresh token is used to obtain new access tokens once the current ones expire.

Automatically refreshing an access token

To set this value, click the edit button in the top right of your Box Postman environment variables. Find the row in the table for the enable_auto_refresh_access_token variable and set the Current Value to true . Next, click Update to save your changes.

Refresh tokens have a longer lifetime than access tokens. The default lifetime for the refresh tokens is 24 hours for single page apps and 90 days for all other scenarios. Refresh tokens replace themselves with a fresh token upon every use.

What is the difference between ID token and access token and refresh token? ›

Access tokens are used in token-based authentication to gain access to resources by using them as bearer tokens. Refresh token is a long-lived special kind of token used to obtain a renewed access token. ID token carries identity information encoded in the token itself, which must be a JWT.

Access tokens are what the OAuth client uses to make requests to an API. The access token is meant to be read and validated by the API. An ID token contains information about what happened when a user authenticated, and is intended to be read by the OAuth client.

OIDC uses JSON Web Tokens (JWT), HTTP flows and avoids sharing user credentials with services. OpenID Connect has consent built-in. This is important as OIDC is often used in consumer-facing services (e.g., a Relying Party), where the sharing of personal data requires the user's explicit consent.

ID tokens shouldn't be used for authorization purposes. Access tokens are used for authorization. The claims provided by ID tokens can be used for UX inside your application, as keys in a database, and providing access to the client application.

Access tokens have limited lifetimes. If your application needs access to a Google API beyond the lifetime of a single access token, it can obtain a refresh token. A refresh token allows your application to obtain new access tokens.

Access tokens vs ID tokens

Access tokens are intended for authorizing access to a resource. It's important that the resource server (your server-side app) accepts only an access token from a client. ID tokens, on the other hand, are intended for authentication.

Unlike access tokens, which are opaque objects that cannot be inspected by the application, ID tokens are meant to be inspected and used by the application.