AccessToken Vs ID Token Vs Refresh Token - What? Why?When?

{
  "token_type": "Bearer",
  "expires_in": 86400,
  "access_token": "vCwWSQiaYhMHN2IbnEijtDWJ-BpiHbPohI6tOVrkrUrL2MqlF05K84MhBzvoC6iShEdUXl7t",
  "scope": "openid profile email photo",
  "id_token": "eyJraWQiOiJzMTZ0cVNtODhwREo4VGZCXzdrSEtQUkFQRjg1d1VEVGxteW85SUxUZTdzIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJmcmlnaHRlbmVkLWhlcnJpbmdAZXhhbXBsZS5jb20iLCJuYW1lIjoiRnJpZ2h0ZW5lZCBIZXJyaW5nIiwiZW1haWwiOiJmcmlnaHRlbmVkLWhlcnJpbmdAZXhhbXBsZS5jb20iLCJpc3MiOiJodHRwczovL3BrLWRlbW8ub2t0YS5jb20vb2F1dGgyL2RlZmF1bHQiLCJhdWQiOiJpVnUwQUMyOFFHLXNwc1psWk1janFRY2EiLCJpYXQiOjE2MDQyMTY1MzgsImV4cCI6MTYwNjgwODUzOCwiYW1yIjpbInB3ZCJdfQ.ZoPvZPaomdOnnz2GFRGbgaW7PPWIMFDqSBp0gbN4An4a9F-Bc-4_T9EBGV8aGetyjZYAON0gjNV0p0NGFiwettePWKuxBzusuGCEd9iXWWUO9-WTF5e2AGr3_jkg34dbxfiFXy3KgH7m0czm809cMaiZ_ofLYgJHVD8lqMQoWifhoNhpjPqa19Svc3nCHzSYHUgTXQWvA56NmQvyVPh_OM7GMpc6zHopmihJqt3eREof8N-bOd7FL39jeam2-k1TFSDogyJE513aC0OssRADr_TWvtL8xoaPkXM_7bXYs9_7erXmzF9la0hvmOuasieetpLhOvFeoiOJWCU9xhxj4Q"
}

Why do we need an Access Token?

Access tokens are used to inform an API that the bearer of the token has been authorized to access the API and perform a predetermined set of actions specified by the scope. It is used to authorize API access.

What is an ID Token?

OpenID Connect always issues ID tokens along with access tokens to provide compatibility with OAuth and match the general tendency for authorizing identity.

ID token carries personal information about end-users that authenticate on an OpenID Connect flow. In addition, this security token contains claims data about the user as saved with the authentication server.

The ID token represents JWT.

For example, if there is an app that uses Google to log in users and to sync their calendars, google sends an ID token to the app that includes information about the user

This token authenticates the user to the application. The audience of this token is set to the application’s identifiers, which means that a specific application should consume the token.

Identity token payload contains “auth_time” (when the end user actually authenticated), “iss” (who has issued the token), “aud” (Intended audience), “sub” (unique identifier of the user), “idp” etc.

Example of ID Token (JWT)

Here is the sample response from the token endpoint! The response includes the ID token and access token.

{
  "token_type": "Bearer",
  "expires_in": 86400,
  "access_token": "vCwWSQiaYhMHN2IbnEijtDWJ-BpiHbPohI6tOVrkrUrL2MqlF05K84MhBzvoC6iShEdUXl7t",
  "scope": "openid profile email photo",
  "id_token": "eyJraWQiOiJzMTZ0cVNtODhwREo4VGZCXzdrSEtQUkFQRjg1d1VEVGxteW85SUxUZTdzIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJmcmlnaHRlbmVkLWhlcnJpbmdAZXhhbXBsZS5jb20iLCJuYW1lIjoiRnJpZ2h0ZW5lZCBIZXJyaW5nIiwiZW1haWwiOiJmcmlnaHRlbmVkLWhlcnJpbmdAZXhhbXBsZS5jb20iLCJpc3MiOiJodHRwczovL3BrLWRlbW8ub2t0YS5jb20vb2F1dGgyL2RlZmF1bHQiLCJhdWQiOiJpVnUwQUMyOFFHLXNwc1psWk1janFRY2EiLCJpYXQiOjE2MDQyMTY1MzgsImV4cCI6MTYwNjgwODUzOCwiYW1yIjpbInB3ZCJdfQ.ZoPvZPaomdOnnz2GFRGbgaW7PPWIMFDqSBp0gbN4An4a9F-Bc-4_T9EBGV8aGetyjZYAON0gjNV0p0NGFiwettePWKuxBzusuGCEd9iXWWUO9-WTF5e2AGr3_jkg34dbxfiFXy3KgH7m0czm809cMaiZ_ofLYgJHVD8lqMQoWifhoNhpjPqa19Svc3nCHzSYHUgTXQWvA56NmQvyVPh_OM7GMpc6zHopmihJqt3eREof8N-bOd7FL39jeam2-k1TFSDogyJE513aC0OssRADr_TWvtL8xoaPkXM_7bXYs9_7erXmzF9la0hvmOuasieetpLhOvFeoiOJWCU9xhxj4Q"
}

Why do we need an ID Token?

The ID token is used to retrieve the user’s basic profile information like name, DOB, email, and phone, which is present in the authentication server. ID token should not be used to gain access to an API.

What is a Refresh token?

• This token is a long-lived token compared to the access token and is used to request a new access token in cases where it has expired.
• It can be considered as credentials used to obtain access tokens.
• It's allowed for long-lived access and is highly confidential.
• Refresh tokens can be used for grant types – authorization code and password credentials grant.
• Refresh tokens are intended for use only with authorization servers and are never sent to resource servers.
• You will receive this in an encoded format only that cannot be decoded. An example could be 494c427ace9e04dea03c7234cea96c5ca53e0ce4ea95147e961fd9ebcf8feb84

Example of Refresh Token

Here is the sample response from the token endpoint! The response includes the access token along with the refresh token.

{
  "access_token": "ya29.a0AfH6SMARVjPq6G2y_P3hn3mbDdnRVrTGwO1ZkTXvUHye9wcpAPyiRKilq6Wh20TRbVx0nA1Nn8z1cpk_Jjs6qRwDvbOFNZhpA8e2GxDRcJ_PlrhlMnauvxktSDkjUyG-NWwuckHpiaOfr_uITriM0aS2t3HbGIKQJiU",
  "scope": "https://mail.google.com/",
  "token_type": "Bearer",
  "expires_in": 3599,
  "refresh_token": "1//0419Pth1mYFyBCgYIARAAGAQSNwF-L9IrcV8zK4wHDznJqUbeXrcEoE2O-Tmz7ryNpztTrLOiYOvs-0z4hxddGBpcKc0pEzLcWFI"
}

Why do we need a Refresh token?

As the access token has defined lifetimes, there could be a possibility that the current access token becomes invalid or expires. This is the token used to request new access tokens without user interaction.

Requesting an access token using a refresh token

While requesting a refresh token, the scope should be set as offline_access to the scope parameter.

Method: POST
Content-Type: application/x-www-form-urlencoded
Authorization: Bearer "access token"
URL: https://authorization-server.com/token
Query Parameters:
  grant_type=refresh_token
  refresh_token=<<refresh_token>>
  scope=offline_access

The application receives an access token with a redirect URI.

{
  "token_type": "Bearer",
  "expires_in": 86400,
  "access_token": "QKY08tqDO8aeNebZbfgUFs1PH-cjerK2WBvE9FZpYGgZHnS_nLfhKYTECMBmPF_chz5GipOA",
  "scope": "photo offline_access",
  "refresh_token": "8V2dMpzRqB5cQDvoTb6X_Msl"
}

Summary

Below is a quick reference of all the tokens at a glance.

• Access tokens are used in token-based authentication to gain access to resources by using them as bearer tokens.
• Refresh token is a long-lived special kind of token used to obtain a renewed access token.
• ID token carries identity information encoded in the token itself, which must be a JWT. It must not contain any authorization information or any audience information — it is merely an identifier for the user.

Copyright Anupam Maiti. All rights reserved. No part of this article, including text, may be reproduced, distributed, or transmitted in any form or by any means, including photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the copyright owner.