---
schema_version: "1"
id: 064dc30da6165be2d72d460c6990fbbd82e5f30a2380d94b56a2146cbac5cb32
title: Access Tokens
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_access_tokens.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_access_tokens.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 91652fd2db52de01f8d1c36d95da377462bd7f2d7eff1c45406e09a77e8d417f
description: "Access tokens are your key to Salesforce APIs. When a client successfully completes an authorization flow, whether it’s a standard OAuth 2.0 flow or a headless identity flow, Salesforce issues an access token that can be used to access protected Salesforce data. Salesforce supports two types of access tokens: opaque tokens and JSON Web Token (JWT)-based access tokens. Each type has its own merits and limitations based on your use case."
products:
  - Security
  - Cross Cloud
release: "264"
---
# Access Tokens

Access tokens are your key to Salesforce APIs. When a client successfully completes an authorization flow, whether it’s a standard OAuth 2.0 flow or a headless identity flow, Salesforce issues an access token that can be used to access protected Salesforce data. Salesforce supports two types of access tokens: opaque tokens and JSON Web Token (JWT)-based access tokens. Each type has its own merits and limitations based on your use case.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

## Opaque Access Tokens

Salesforce traditionally issues opaque access tokens during authorization flows. The hallmark of these tokens is that they’re hard to read without additional help. From the perspective of your client apps, an opaque token is an inscrutable string of random characters. Your clients can’t understand or validate the data represented by the token unless they call a Salesforce endpoint. Typically, to get information about an opaque access token, you call the Salesforce introspection or User Info endpoints.

## JWT-Based Access Tokens

JWT-based access tokens are less traditional, but that doesn’t mean they’re less capable. Instead of being an opaque string, a JWT access token is formatted as a JSON object with all the information necessary to validate it. JWT-based access tokens can be introspected locally, without calling a Salesforce endpoint.

## When to Use Each Token Type

If you’re only interacting with one Salesforce instance, opaque tokens are more appropriate. You can easily make calls to Salesforce endpoints without slowing performance. You can also use opaque tokens to access the Salesforce user interface, which you can’t do with JWT-based access tokens.

By comparison, JWT-based access tokens are better suited for use cases where you have a wide range of third-party services and you need a Salesforce token that works with all of them. Because you can introspect the tokens locally, you can avoid multiple, repeated callouts to Salesforce endpoints, which can slow performance when you’re working with a range of APIs.

## Comparing Token Types

Besides the major distinction between these token types, this table summarizes the key functional differences between opaque and JWT-based access tokens. Before using either type, make sure that you thoroughly understand their differences and their impact.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d85938e98">Functionality</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d85938e101">Opaque Token</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d85938e104">JWT-Based Token</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Functionality" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e98 ">Validation and introspection</td>

            <td data-label="Opaque Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e101 ">Can be validated and introspected only with a call to a Salesforce endpoint. As
              a result, they’re ideal for use cases with just one Salesforce instance but poorly
              suited for use cases with multiple services.</td>

            <td data-label="JWT-Based Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e104 ">Can be locally validated and introspected, making them more compatible with
              external services</td>

          </tr>
          <tr class="">
            <td data-label="Functionality" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e98 ">UI access</td>

            <td data-label="Opaque Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e101 ">
              <ul>
                <li>Can be used to directly access the Salesforce UI</li>

                <li>Can be bridged into the Salesforce UI using the
                  <samp class="filepath">services/oauth2/singleaccess</samp> endpoint
                </li>

              </ul>
            </td>

            <td data-label="JWT-Based Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e104 ">
              <ul>
                <li>Can be bridged into the Salesforce UI by using the
                  <samp class="filepath">services/oauth2/singleaccess</samp> endpoint
                </li>

                <li>Can be indirectly used to access the Salesforce UI by using a hybrid OAuth
                  flow that generates an opaque access token. The hybrid flow returns the opaque
                  token in the <code>parent_sid</code> field in the token
                  response. You can then use this opaque token for direct UI access.</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Functionality" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e98 ">Timeout</td>

            <td data-label="Opaque Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e101 ">Each time the token is used, its validity is extended.</td>

            <td data-label="JWT-Based Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e104 ">The timeout value is fixed and can’t be extended.</td>

          </tr>
          <tr class="">
            <td data-label="Functionality" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e98 ">User deactivation</td>

            <td data-label="Opaque Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e101 ">If the user holding the token is deactivated, the token immediately stops
              working because any calls to Salesforce endpoints fail.</td>

            <td data-label="JWT-Based Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e104 ">If a user is deactivated, the token is still technically valid until it times
              out. </td>

          </tr>
          <tr class="">
            <td data-label="Functionality" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e98 ">Enablement</td>

            <td data-label="Opaque Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e101 ">Enabled by default</td>

            <td data-label="JWT-Based Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e104 ">Must be enabled on your external client app or connected app</td>

          </tr>
          <tr class="">
            <td data-label="Functionality" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e98 ">Headless Guest User Flow and unique visitor ID (UVID)</td>

            <td data-label="Opaque Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e101 ">Not supported</td>

            <td data-label="JWT-Based Token" class="slds-cell-wrap" style="vertical-align:top;" headers="d85938e104 ">Required to use the guest user flow and UVID</td>

          </tr>
        </tbody>
      </table>

- **[JWT-Based Access Tokens](https://help.salesforce.com/s/articleView?id=xcloud.jwt_access_tokens.htm&release=264.0.0&type=5)**  
    Salesforce supports two types of access tokens: opaque tokens and JSON Web Tokens (JWT)-based access tokens. An opaque access token is formatted as a string that you can’t decode unless you call the Salesforce User Info endpoint. A JWT-based access token is formatted as a JSON object that contains all of the information required to authorize an app. This transparent format makes JWT-based access tokens easier to use for services built outside of the Salesforce platform. You can easily parse and validate JWT-based access tokens locally on your off-platform service, without calling a Salesforce endpoint. By locally introspecting tokens, you can improve the performance and efficiency of your authorization flows.
- **[Issue JWT-Based Access Tokens](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_enable_jwt.htm&release=264.0.0&type=5)**  
    Enable a Salesforce external client app or connected app to issue JSON Web Token (JWT)-based access tokens instead of opaque tokens. Unlike opaque tokens, JWT-based access tokens have a transparent format, so you can introspect them without calling a Salesforce endpoint. This functionality makes them handy for use cases where you’re calling multiple external systems.
- **[Revoke All JSON Web Token (JWT)-Based Access Tokens](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_revoke_jwt.htm&release=264.0.0&type=5)**  
    If necessary, you can revoke all JSON Web Token (JWT)-based access tokens issued by all external client apps and connected apps. Revoking JWT-based access tokens invalidates their signing keys, which makes the tokens unusable.
- **[Revoke OAuth Tokens](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_revoke_token.htm&release=264.0.0&type=5)**  
    Revoke an OAuth token if you don’t want a client to access Salesforce data or if you don’t trust the client to discontinue access on its own.