Auth0 Access Token Formats: Opaque Versus JSON Web Tokens
Last Updated:
Overview
Auth0 issues access tokens in either an opaque or JSON Web Token (JWT) format. Opaque tokens act as a reference to information stored on a server, while JWTs are self-contained and contain claims about an entity. Requesting a token with an audience parameter ensures Auth0 returns the token in JWT format.
Applies To
- Auth0
- Access Tokens
Solution
What are the different Auth0 access token formats?
Review the provided video and the following descriptions to understand the differences between access token formats.
- JWT: These tokens follow the JWT standard and contain claims (information about an entity). They are self-contained, meaning the recipient does not need to call a server to validate the token. Access tokens for the Auth0 Management API or custom APIs registered with Auth0 are typically JWTs.
- Opaque Token: These tokens use a proprietary format and serve as references to information stored on a server. The recipient must call the issuing server to validate an opaque token and retrieve user information (for example, using the /userinfo endpoint for tokens that Auth0 issues).
How is an access token received in JWT format?
Configure the token request with an audience parameter to receive an access token in JWT format.
- Include an audience parameter in the token request, specifying the intended recipient (e.g., the identifier of a registered custom API), as explained in the Get Access Tokens documentation.
