IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Tokens & identity standards
Many scary acronyms are just machinery around one simple object: the token. Your goal: say what a token holds, name the three kinds, and match each standard to its job.
- A token is a signed pass that shows who you are and what you may do.
- There are three kinds: ID, access and refresh tokens.
- A signed token cannot be changed in secret, but a stolen one still works until it expires.
- OAuth gives access. OIDC adds login. SCIM manages accounts.
What a token is
a wristband at a temple festival. You show your ID once at the gate (the IdP). You get a wristband (the token). Inside, people only check the wristband. It has an end time, and it expires.
You met tokens in The Absolute Basics. The IdP issues three kinds: an ID token, an access token and a refresh token.
ID token
"Here is who signed in." It is for the app: your name, your user ID and how you signed in.
Access token
The wristband itself. You show it to an API to do something. It is short-lived: minutes to an hour.
Refresh token
A longer-lived voucher. The app uses it to get new access tokens quietly. Thieves love it, so it gets special care (the rotation lesson).
Inside a token
Most tokens are JWTs (JSON Web Tokens). They have three parts. They are signed, so nobody can forge one or change it without being caught.
1 · Header
It says "I am signed with key #42". That is the method and the key ID used to check the seal.
2 · Payload (the claims)
sub: maya-8271 · exp: 14:35 · scope: invoices:read pay · acr: level-4 · amr: hwk · persona: customer
3 · Signature
The seal that shows nothing was changed ✒️. The receiver works it out again and compares.
Claims are the facts inside the token: who, when and how strong. Scopes are the permissions it gives, such as "may read invoices, may pay". Two claims matter for step-up. acr says how strong the login was. It uses the levels from the proof lesson. amr says which method was used, such as a passkey or an OTP. An API can say "this action needs acr level-4". That is step-up at work.
A signed token cannot be changed without breaking the seal. But a stolen token that is still valid works. A stateless token carries everything the API needs, so the API cannot easily cancel it. It stays valid until it expires. It is like a paper ticket: the guard checks the stamp, not a list. So a kill switch needs extra machinery (when things go wrong).
The standards, one line each
| Standard | What it does |
|---|---|
| OAuth 2.x | The rules for getting and using access tokens. An app can act for me without my password. |
| OIDC (OpenID Connect) | A login layer on top of OAuth. It adds the ID token: "who just signed in?". Today's default. |
| SCIM v2 | Not about logins. It creates, updates and deletes accounts across systems automatically (the lifecycle lesson). |
| CIBA | Approval happens on a different device from the request. See the figure below. |
| RAR (Rich Authorization Requests) | The token holds the exact action it allows ("pay $500 to Acme, once"). It is not a vague permission. |
Maya's big transfer
Go deeper: more standards and RFC numbers
| Standard | What it does |
|---|---|
| SAML | An older login standard that uses XML. It is still everywhere in company software. You connect to it with federation. |
| LDAP | The old standard for asking a directory questions. Many older systems still use it. |
| Token exchange (RFC 8693) | Trade one token for another with different, usually smaller, powers. Agents use it to act "on behalf of" people (the agents lesson). |
| DPoP (RFC 9449) | Ties a token to a key that only its rightful owner holds, so a stolen copy is useless. Such tokens are called sender-constrained. (mTLS is the other way.) |
SCIM v2 is RFC 7644. RAR is RFC 9396. People call RAR "what you see is what you sign". The refresh-token voucher is why users are not asked to log in every 15 minutes.
🧪 Interactive lab — enable JavaScript to play with this one.
Look at the three parts of a real JWT with ID Token Check. Then check the signing keys behind the seal with JWKS Check.