Access Token

The Access Token is a short-lived credential issued by Corppass after a successful authorization code exchange. It is used to authorize access to protected resources, such as the Userinfo Endpoint.

Unlike traditional Bearer tokens, this token is Sender-Constrained. It is cryptographically bound to the DPoP private key used during the token exchange request.

Token Usage

To access a protected endpoint, the client must present the Access Token in the Authorization header using the DPoP scheme (not Bearer).

The request must also include a DPoP Proof in a separate header. This proof verifies that the client making the request holds the same private key that was used to request the token.

GET /<resource-endpoint>
Authorization: DPoP eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
DPoP: <signed-DPoP-proof>

For a complete code sample showing how to construct the request headers and the accompanying DPoP proof, refer to Userinfo Endpoint.

Token Opacity

Relying Parties (RPs) must treat the Access Token as an opaque string.

• Do not attempt to decode, parse, or inspect the token structure.

• Do not rely on any internal claims (e.g., sub, exp) found within the token for application logic.

While the token is technically issued as a Signed JWT (JWS), its internal structure is intended solely for the Resource Server (Corppass) - for internal validation and rotation without breaking client integrations.

Token Lifecycle

• Expiration: The Access Token is valid for 10 minutes (600 seconds) from the time of issuance.

• Renewal: Once expired, the client must initiate a new Authorization Flow to obtain a new token (refresh tokens are currently not supported).