It may refer to an authenticator that proves control of a secret, a one-time value sent during an exchange, or a session token presented after sign-in. The protocol — not the label — determines its meaning and security properties.
Current NIST digital-identity guidance calls the user-held means of authentication an authenticator; earlier editions called it a token. Software documentation also uses “auth token” for session secrets and OAuth access tokens, even though those values continue a session or convey authorization after authentication. Designers should name the exact token type and protocol instead of relying on the umbrella term.
Key points
Possible formsHardware authenticators, one-time passcodes, signed protocol messages, bearer access tokens, and session cookies have different trust and replay properties.
ProtectionKeep token values out of URLs and logs, use protected transport and storage, validate issuer and audience where applicable, and restrict access by client code.
LifecycleDefine issuance, binding, scope, expiry, rotation, revocation, replay detection, and response to suspected theft for each token type.
Important limitationA bearer token can grant its holder the token’s effective access without another identity check. Multi-factor sign-in does not protect a session if a usable post-authentication token is stolen.