Access Tokens
An access token is provided by an OpenID Connect provider. Like a user session, it contains attributes such as assigned organizations, roles, and permissions. Depending on the provider’s configuration (e.g., Keycloak), an issued access token is valid for a short period of time.
Using the Access Token
To use access tokens for authentication at the API endpoints, this feature must be enabled in the identity provider’s backend Connection settings.
The token can then be transmitted as a bearer token in the ` Authorization` header.
The BPC then verifies whether this token was signed by the configured OIDC provider, whether the token has not expired, and whether the respective roles or permissions for the endpoint are granted.
Keywords:
