Security
Bearer token for API authorization
Optional
refresh_Refresh token (requires offline_access
scope)
JWT containing user identity claims
Optional
token_Typically "Bearer"
Token validity in seconds (default: 86400)
Granted permissions space
Standardized token response structure for Auth0 authentication flows
Remarks
Token Lifetime Management:
Cache tokens according to
expires_in
valueRotate refresh tokens using
offline_access
scopeRevoke compromised tokens immediately
Store tokens in secure, encrypted storage
Never expose in client-side code or logs