Skip to main content

​
About Tokens

Digital Identity Management uses action and other OAuth tokens to facilitate onboarding and authentication. An action token is a unique one-time use token that triggers a one-time action when redeemed. Tokens are context-aware so that, upon token redemption:
  • Digital Identity Management knows what task needs to be performed (i.e., what Process needs to be executed) on what resources.
  • Digital Identity Management knows who is redeeming the token, even if no current Digital Identity Management User session exists.

​
Action Tokens

Digital Identity Management issues action actions tokens and sends them to end users in different ways depending on your notification settings. Many Digital Identity Management Processes can send both a long-form clickable link (URL) and a short-form custom one-time password (OTP) to the selected contact channel e.g., email or sms. The token types sent over a channel are based on the HTML & thymeleaf templates stored in the Digital Identity Management data store. These templates determine the content of the notification (messaging, branding) as well as the token type (link, OTP, or both) based on the user’s channel type, such as email, or sms. The action tokens are used in the Digital Identity Management Process to prompt the users as to what they need to do next or inform them that a process/action has completed. Configure the token settings from Admin console > Authentication. Token URL (Long form) Also know as a long form clickable link, this is a redirect URL with the full action token value appended to the end of the string. These links are used in cases to direct users to the next step in their journey from a separate point of entrance, or when an new end user has been invited to share access to an account or service owned by another user. When the end user clicks the link in their email or SMS notification, their browser then redirects back to a landing page on your client application, according to the redirect URL. The landing page takes the token value from the URL and uses it to call the Session Token API to invoke a Digital Identity Management Process (defined in the token value itself). Token One-Time Passcode (Short form) This One-Time (OTP) token is a short form custom code that represents the full action token stored in the cloud. These are used in cases where the user completes a Process, and your client then prompts the user to enter the code Digital Identity Management sent to their email or phone. When the user receives the code, they enter it to your client application UI, and the client uses that code to call the Session Token API and invoke a Digital Identity Management Process.

​
OAuth Tokens

These tokens are configured when creating a new OIDC client and are listed here for reference purposes only. Access Tokens Access tokens are OAuth authorization tokens used by users to access resources. Access and refresh tokens are classified as bearer tokens because any user that bears these tokens can access protected resources. server. For more details, see Access Tokens. ID Tokens In an OIDC-based Authorization Grant flow, an RP (the client) requests specific information about the subject (end user) from the issuer (authN server), and the issuer creates and provides an ID token to that RP. The encrypted payload contains claims, which are pieces of data that the server provides to identify the subject: the subject’s name, a unique identifier, their email address, phone number, and such. Some of these claims are specified by the OIDC standard, but not every ID token contains all claims. OIDC also defines scopes as granting access to particular pieces of claim data. Refresh Tokens An OAuth 2.0 refresh token enables a client application to get a new access token from the authorization server, in order to replace an existing or expired access token. If a client reuses the same access token in repeated requests to the resource server, this can run the risk of that token being intercepted and compromised. To mitigate this problem, access tokens have a short expiry time, usually minutes. Refresh tokens are long-lived, usually days, and can also be set to expire. If token expiration occurs, the resource owner must go through another OAuth 2.0 grant flow to issue fresh tokens to the client. Parent topic:Authentication