Skip to lesson
Exit
Identity & Access Deep Dive1 / 3

1 min lesson

Three token types, three jobs

Use the evidence to decide "Which token goes where: access, refresh, ID?" Explain the choice plainly.

Step 1 of 3

Three token types, three jobsknow where each is validated

Tokens
Access token
Short-lived, often minutes; sent to APIs; validated by the resource server against scopes
Refresh token
Long-lived; held carefully; traded for a new access token at the token endpoint
ID token
OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. only; proves who logged in; validated by the client, never sent to APIs

Sending an ID token to an API or an access token to a client is a classic tell.

Learn more

Full explanation

The pattern you'll actually build

The pattern you'll actually buildautomating the SaaS stack

Most of your OAuth work as an IT engineer is service-to-service: a script that deactivates an Okta user, pulls Okta logs or manages Google Workspace groups. That pattern is client credentials, or a Google service account with domain-wide delegation. No person logs in.

Google Workspace

Service account + domain-wide delegation.

Scope it to exactly the Admin SDK methods you call: directory read/write only.

Slack

Bot/app token with granular OAuth scopes.

Request users:read, not admin, unless you truly run SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition./admin actions.

Okta

API token or OAuth client-credentials app.

Prefer a scoped OAuth service app over a long-lived super-admin API token.

Learn more

Full explanation

Security gotchas to name unprompted

Security gotchas to name unprompted

  • Exact-match redirect URIs. Wildcards turn PKCE into theater, because the code gets delivered to the attacker's URL.
  • Least-privilege scopes. A token that reads one group is a smaller breach than one that admins the tenant. Scope is your blast-radius dial.
  • Secret rotation. Client secrets and API tokens live in a secrets manager, rotate on a schedule and never sit in a repo or a Slack message.
  • Token storage. Refresh tokens are bearer credentials. Anyone who has one is the user until it's revoked.
Interview move

When asked to design an integration, lead with the secret question: "Is there a human and a browser, or is this a backend service? If it's my automation calling the Okta API, I'd use client credentials with a scoped service app and keep personal admin tokens out of it." Asking that first shows you reach for least privilege by reflex.

Learn more

Optional practice

Test yourself on Three token types, three jobs

QYou're writing a Python script to deprovision users through the Okta API. Which OAuth grant fits and what's the access principle?