# What is an Authentication Token?

> Authentication token is a context-dependent term for a value or device used during authentication or to carry forward the result of successful authentication.

- Canonical URL: https://yellowcube.eu/glossary/authentication-token/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It may refer to an authenticator that proves control of a secret, a one-time value sent during an exchange, or a session token presented after sign-in. The protocol — not the label — determines its meaning and security properties.

Current NIST digital-identity guidance calls the user-held means of authentication an authenticator; earlier editions called it a token. Software documentation also uses “auth token” for session secrets and OAuth access tokens, even though those values continue a session or convey authorization after authentication. Designers should name the exact token type and protocol instead of relying on the umbrella term.

### Key points

- **Possible forms:** Hardware authenticators, one-time passcodes, signed protocol messages, bearer access tokens, and session cookies have different trust and replay properties.
- **Protection:** Keep token values out of URLs and logs, use protected transport and storage, validate issuer and audience where applicable, and restrict access by client code.
- **Lifecycle:** Define issuance, binding, scope, expiry, rotation, revocation, replay detection, and response to suspected theft for each token type.
- **Important limitation:** A bearer token can grant its holder the token’s effective access without another identity check. Multi-factor sign-in does not protect a session if a usable post-authentication token is stolen.

### Related terms

[Authentication](<https://yellowcube.eu/glossary/authentication/>) · [OAuth 2.0](<https://yellowcube.eu/glossary/oauth-2-0/>) · [OpenID Connect (OIDC)](<https://yellowcube.eu/glossary/openid-connect/>) · [API key](<https://yellowcube.eu/glossary/api-key/>) · [Account takeover (ATO)](<https://yellowcube.eu/glossary/account-takeover/>)

### Sources

[NIST SP 800-63B-4: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html) · [RFC 6750: OAuth 2.0 Bearer Token Usage](https://www.rfc-editor.org/rfc/rfc6750)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.