What are claim tokens?

To name a few, you have Gold Bullion, Mr. Fuzzy Tokens, Caps, and more. Among these currencies is the less widely-used one called Claim Tokens. This special currency is only used in a specific area and it takes a while to accumulate a large number of them. Spending this currency, however, can get you some pretty useful items.

What are authorization tokens and scopes?

These tokens consist of claims, which are assertions made by the Authorization Server about a party (such as a user or client). Claims, in turn, are grouped into scopes to make it easier for clients to request sets of claims. For example, instead of requesting ten different claims, a client might ask for a scope to grant all of those claims.

Is the content of a token a contract?

Still, one area that tends to be overlooked, even when following best practices for claims and scopes, is that the content of a token should be viewed as a contract. The content of a token should be viewed as a contract or interface between the Authorization Server and the token consumer. Depending on the token type, the consumer is:

What is a centralized token service?

The centralized Token Service should be able to easily map claims to the different types of tokens it issues. Administrators should be able to effortlessly assign claims to scopes and decide the token type — an access token, an ID token, or a wrapper token.