> For the complete documentation index, see [llms.txt](https://ztrust.gitbook.io/ztrust-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ztrust.gitbook.io/ztrust-documentation/user-manual-ztrust-v4.1/5.-securing-applications/5.1-tokens-used-in-ztrust.md).

# 5.1 Tokens used in ZTrust

**ZTrust** issues different types of tokens as part of the **OpenID Connect (OIDC)** flow. These tokens carry identity, authentication, and authorization data that applications and APIs rely on to enforce secure access. Each token serves a specific purpose:

{% hint style="info" %}

#### Access Token

* Purpose: Grants access to protected resources (APIs).
* Format: Typically a JWT (JSON Web Token).
* Audience: Meant for resource servers (APIs).
* Lifespan: Short-lived (default: 5 minutes in ZTrust).
* Content:
* Claims about the user (username, roles, etc.)
* Client info
* Token expiry time
* Scopes granted (like openid, email, etc.)

Usage: Sent in the Authorization header of API requests:\
Authorization: Bearer \<access\_token>

It is used to authorize access to backend services.
{% endhint %}

{% hint style="info" %}

#### ID Token

* Purpose: Contains identity information about the user.
* Format: JWT
* Audience: Intended for the client (application).
* Lifespan: Same as access token (default: 5 minutes).
* Content:
* User profile information (name, email, preferred username, etc.)
* Issuer (iss), audience (aud)
* exp, iat, auth\_time
* Usage: Mainly used for authentication, especially in OpenID Connect login flows.

It is used by the client app to verify the user's identity.
{% endhint %}

{% hint style="info" %}

#### Refresh Token

* Purpose: Used to obtain a new access token (and optionally a new ID token) without requiring the user to log in again.
* Audience: Meant for the authorization server (ZTrust) only.
* Lifespan: Long-lived (default: 30 minutes in ZTrust, or configurable).
* Content:
* Reference to the original session
* Scopes
* Token expiry

Usage: Sent to ZTrust’s token endpoint like:\
POST /protocol/openid-connect/token

grant\_type=refresh\_token

refresh\_token=\<refresh\_token>

It helps maintain sessions without user interaction.
{% endhint %}