What is an access token?¶
An access token is a digital credential that allows a device, application or service to access part of a cloud account.
It is often issued after authentication and can be used without sending the password again for every request.
What this means in practice¶
An access token may permit an application to read files, send messages, view profile information or perform other actions within the permissions granted. The token may be valid for only a short time, but while active it can allow access without a fresh login.
A legitimate application may use the token in the background. An attacker may steal it from a device, browser or application and use it elsewhere. A malicious application may obtain one through deceptive consent.
When investigating token-based activity, identify which application received the token, what permissions it carried, when it was issued, when it expired or was revoked, and what events were linked to it.
What this does not show on its own¶
The dangerous assumption is that possession of the password is always required for later cloud activity.
The token usually represents an account, application, session and set of permissions. It does not necessarily identify the person using it at that moment.
Provider logs may record the application, account, permissions, token issue time, IP address, device information and later actions. They may not display the token itself, and investigators should not copy or use live tokens without specialist advice.
A password reset may not immediately invalidate every access token. Revocation, session termination or removal of delegated application access may be needed separately.
What to do next¶
Do not describe token use as a fresh login unless the evidence shows a new authentication event.
Key takeaway
An access token authorises limited cloud activity after authentication, so trace the application, permissions and session rather than assuming each action required the user’s password.