These versions determine the claims that are in the token and make sure that a web API can control the contents of the token. There are two versions of access tokens available in the Microsoft identity platform: v1.0 and v2.0. It doesn't apply to tokens issued for Microsoft-owned APIs, nor can those tokens be used to validate how the Microsoft identity platform issues tokens for a registered API. See the following sections to learn how an API can validate and use the claims inside an access token.Īll documentation on this page, except where noted, applies only to tokens issued for registered APIs. This data allows the application to do intelligent caching of access tokens without having to parse the access token itself. This information includes the expiry time of the access token and the scopes for which it's valid. When the client requests an access token, the Microsoft identity platform also returns some metadata about the access token for the consumption of the application. Tokens that are received for a Microsoft API might not always be a JWT and can't always be decoded.įor details on what's inside the access token, clients should use the token response data that's returned with the access token to the client. For validation and debugging purposes only, developers can decode JWTs using a site like jwt.ms. These proprietary formats might be encrypted tokens, JWTs, or special JWT-like tokens that won't validate.Ĭlients must treat access tokens as opaque strings because the contents of the token are intended for the API only.
Microsoft-developed APIs like Microsoft Graph or APIs in Azure have other proprietary token formats. The format of the access token can depend on how the API that accepts the token is configured.Ĭustom APIs registered by developers on the Microsoft identity platform can choose from two different formats of JSON Web Tokens (JWTs) called v1.0 and v2.0.
Some identity providers (IDPs) use GUIDs and others use encrypted blobs. Per the OAuth specification, access tokens are opaque strings without a set format. Access tokens are used by web APIs to perform authentication and authorization. Access tokens enable clients to securely call protected web APIs.
0 kommentar(er)
