Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between an access token and an ID token?
Short answer
An access token is the permission that lets an application access an API (e.g., the provider's user info endpoint) on the user's behalf; its content is meaningful not to the application but to the API being accessed, and its format varies by provider (RFC 6749). An ID token, on the other hand, is a JWT signed by the provider that states who the user is; it exists only in OpenID Connect and is for the application itself (OpenID Connect Core 1.0). In TR7 AGS, the OAuth2 type obtains the identity from the user info endpoint with the access token; the OpenID Connect type additionally reads the ID token, whose signature is verified with the JWKS URI. While Revoke Tokens on Logout is on, when the session is closed, the session's tokens are revoked by being sent to the provider's Token Revocation URL address.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers | Provider Type = OAuth2 or OpenID Connect | Whether the identity is obtained with the access token or with the ID token |
| Same form (Custom Provider) | Token URL, User Info URL, User Info Request Method (default: GET with Bearer header) | Where the tokens are obtained and where the access token is sent in the user info request |
| Same form (OpenID Connect) | JWKS URI, Skip Signature Verification, Skip Nonce Validation | Verification of the ID token |
| Same form | Revoke Tokens on Logout (off by default), Token Revocation URL (only in Custom Provider) | Revocation of the tokens at the provider on logout; for built-in providers, the revocation address comes from the catalog |
Comparison
| Access token | ID token | |
|---|---|---|
| Purpose | Permission to access the API | The user's identity |
| For whom | Resource server (API) | Application (client) |
| Format | Varies by provider (opaque or JWT) | Always a signed JWT |
| Flow it exists in | OAuth 2.0 and OpenID Connect | Only OpenID Connect |
| Use in TR7 | User info request (OAuth2 and OpenID Connect) | Identity and signature verification (OpenID Connect) |
Common Misconceptions
- "An access token proves the user's identity." An access token is an access permission; the application learns the identity from the ID token or from the user info response.
- "APIs are accessed with the ID token." The ID token is for the application; in API calls, the access token is sent.
- "Tokens are always revoked on logout." Revocation is performed only while Revoke Tokens on Logout is on; the option is visible while a token revocation address of the provider is defined.
How it is done in the documentation
