An access token is a software credential that lets an application access a protected API or resource with specific permissions. It represents authorization, not proof of a user's identity, and is usually time-limited and issued after sign-in or another approved authorization flow.
Access Token
What Is an Access Token?
An access token is a software credential that lets an application call a protected API with specific permissions. It represents authorization, not identity, and should be treated as a secret. Tokens commonly include scopes, an intended API audience, and an expiry time.
How an Access Token Works
- A user or service approves requested permissions.
- An authorization server issues a token.
- The app sends it in an Authorization: Bearer header.
- The API validates it and permits only allowed actions, such as reading a calendar but not deleting events.
Access Token vs. ID Token vs. Refresh Token
| Token | Purpose | Handling |
|---|---|---|
| Access | Call an API | Send only to its intended API |
| ID | Describe a signed-in user | Use in the client, not for API access |
| Refresh | Obtain new access tokens | Store with stricter protection |
A JWT is a possible token format, not a synonym for an access token.
Benefits of Access Tokens
They support safer integrations.
- Scopes enforce least-privilege access.
- Short expiry limits exposure.
- Apps can access APIs without receiving a password.
Practical Limits and Security Risks
Tokens can still be misused if stolen.
- Broad scopes and leaked logs can expose data.
- Expired tokens cause failed requests.
- Revoking self-contained tokens may be difficult.
Access Token Security Checklist
- Use HTTPS, short expiry, minimal scopes, and server-side storage where possible.
- Never place tokens in URLs, source control, or logs.
- Validate signature, issuer, audience, expiry, and scopes at the API.
- Treat personal access tokens, including GitHub personal access tokens, like passwords.
Access Tokens in Apps Built With Emergent
When building API integrations with Emergent, use secure token handling and least-privilege permissions. Explore the Token glossary, Learn hub, and AI tools for software development resources for practical guidance.
Frequently Asked Questions
Your Questions, Answered
This will automatically populate, don't change
Don't change this element unless you know what you are doing
How do I use an access token?
Send it to the intended API, usually in the Authorization header as a Bearer token. Do not send it to unrelated services.
What is the difference between an access token and a refresh token?
An access token calls an API. A refresh token is used to request a replacement access token after the first one expires.
Is a JWT the same as an access token?
No. JWT is a token format. An access token is a credential purpose and may be formatted as a JWT or as an opaque string.
Does an access token expire?
Usually. Expiry reduces the harm if a token is exposed. The issuing authorization server sets the lifetime.
How do I fix an expired access token?
Request a new access token, often by using a valid refresh token or repeating the approved sign-in flow.
How do I create a GitHub personal access token?
In GitHub settings, open Developer settings, create a personal access token, choose only needed permissions, copy it once, and store it securely.
Start Building
on Emergent today
on Emergent today
Start Building
