Opaque Access Token
An opaque token is a high-entropy random identifier with no useful client-readable claims embedded in the string. The authorization server stores token metadata server-side; resource servers introspect or look up the token to authorize requests. Unlike a signed JWT or JWS, clients and intermediaries cannot decode identity, scopes, or expiry from the token alone without calling the issuer. Opaque tokens simplify immediate revocation and keep claim data off the client, at the cost of a datastore or introspection round-trip on each use or via caching. Many OAuth deployments issue opaque access tokens to browsers while using JWTs internally between services. Choosing opaque versus JWT formats is an architecture decision about revocation latency, scale, and privacy of claims in transit.
Why It Matters
Teams often default to JWTs for every public token and then struggle with revocation and claim leakage. Opaque reference tokens restore server-side control when instant invalidate matters more than pure edge-stateless verification. Compare both approaches explicitly — including operational cost — before locking your public API token format for years. Choose opaque access tokens when instant revoke and claim privacy matter more than edge-offline verify. Keep JWTs for internal service tokens if that split reduces introspection load while still meeting your threat model.
Related Terms
Related Comparisons
Related Tools
Related Articles
Frequently Asked Questions
Can an opaque token also be a JWT?
By definition opaque tokens are unstructured references. If the string is a verifiable JWT, it is a JWT — choose one model per token type and document it clearly.
Are opaque tokens always more secure than JWTs?
They improve revocation and hide claims, but still require TLS and careful storage. Overall security depends on the full design, not the token string format alone.
Do opaque tokens use JOSE signatures?
No. Integrity lives in the authorization server store. Clients present the reference; servers look up grants. JOSE signatures apply to JWS/JWT formats instead.