Access Tokens, Refresh Tokens & Scopes
Understand the tokens OAuth2 issues, how refresh tokens keep sessions alive, and how scopes limit what a token can do.
Tokens Are the Currency of OAuth2
After a successful flow, OAuth2 hands the client a token instead of the user's credentials. The client presents this token to the resource server to access protected data.
The Access Token
An access token is a short-lived credential proving the client may call an API on the user's behalf. It is sent on each request, usually in the Authorization header.
GET /api/profile
Authorization: Bearer eyJhbGciOi...All lessons in this course
- OAuth2: The Delegation Protocol
- OAuth2 Roles & Terminology
- Core Grant Types Overview
- Access Tokens, Refresh Tokens & Scopes