Toggle Side Panel
Close search

Activity › Forums › Salesforce® Discussions › State differences between Bearer and OAuth 2 tokens in Salesforce?

Tagged: , , , , , , ,

  • saloni gupta

    Member
    August 21, 2017 at 2:02 PM

    Hi aman,

    OAuth 2.0 Bearer Token profile brings a simplified scheme for authentication. This specification describes how to use bearer tokens in HTTP requests to access OAuth 2.0 protected resources. Any party in possession of a bearer token (a "bearer") can use it to get access to the associated resources (without demonstrating possession of a cryptographic key). To prevent misuse, bearer tokens need to be protected from disclosure in storage and in transport.

    token_type is a parameter in Access Token generate call to Authorization server which essentially represents how an access_token will be generated and presented for resource access calls. You provide token_type in the access token generation call to an authorization server.

    The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes). The client must not use an access token if it does not understand the token type.

  • Avnish Yadav

    Member
    September 30, 2018 at 1:15 AM

    Hello,

    Bearer Token
    A security token with the property that any party in possession of the token (a "bearer") can use the token in any way that any other party in possession of it can. Using a bearer token does not require a bearer to prove possession of cryptographic key material (proof-of-possession).

    The Bearer Token or Refresh token is created for you by the Authentication server. When a user authenticates your application (client) the authentication server then goes and generates for your a Bearer Token (refresh token) which you can then use to get an access token.

    The Bearer Token is normally some kind of cryptic value created by the authentication server, it isn't random it is created based upon the user giving you access and the client your application getting access.

    Thanks.

Log In to reply.

Popular Salesforce Blogs

Popular Salesforce Videos