Q11: What are the differences between Access Tokens, ID Tokens, and Refresh Tokens?
Each token type serves a distinct security purpose in modern token-based architectures:
Token Characteristics Matrix
Access Token:
For API Resource Servers | Short-Lived (5-15 mins)Used to access protected APIs. Opaque or JWT. Contains scopes and permission claims.
ID Token:
For Client Application | Read Once upon AuthMust be a JWT. Contains profile assertions about the user for the UI to consume.
Refresh Token:
For Authorization Server | Long-Lived (Days/Months)Used to fetch new Access Tokens silently without forcing user re-authentication.
Key Takeaways
- Access tokens authorize API calls; ID tokens inform client applications about user profile details.
- Client applications must never send ID Tokens to API Resource Servers for authorization purposes.