> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ulm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Tokens

Access tokens are OAuth authorization tokens. When a client wants to access a resource server, it presents an access token in the HTTP authorization header as **`bearer: X`**, where **`X`** is the token string.

**Note:** Access and refresh tokens are classified as **bearer tokens** because any actor that bears these tokens can use them to access protected resources. The client must guard these tokens closely. Any actor that steals them, and therefore bears them, can do whatever the legitimate actor could do.

In standard OAuth 2.0, the access token is not defined beyond an ASCII string. When a token is presented to the resource server, that server inspects the token through means that are opaque to the client. However, Digital Identity Management access tokens are JSON Web Tokens (JWTs) and can therefore be inspected locally by the resource server.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.