> For the complete documentation index, see [llms.txt](https://docs.corppass.gov.sg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.corppass.gov.sg/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/3.-token-endpoint/access-token.md).

# Access Token

The **Access Token** is a short-lived credential issued by Corppass after a successful authorization code exchange. It is used to authorize access to protected resources, such as the [Userinfo Endpoint](/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/4.-userinfo-endpoint.md).

Unlike traditional Bearer tokens, this token is **Sender-Constrained**. It is cryptographically bound to the DPoP private key used during the token exchange request.

## Token Usage

To access a protected endpoint, the client must present the Access Token in the `Authorization` header using the `DPoP` scheme (not `Bearer`).

The request must also include a DPoP Proof in a separate header. This proof verifies that the client making the request holds the same private key that was used to request the token.

```http
GET /<resource-endpoint>
Authorization: DPoP eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
DPoP: <signed-DPoP-proof>
```

For a complete code sample showing how to construct the request headers and the accompanying DPoP proof, refer to [Userinfo Endpoint](/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/4.-userinfo-endpoint.md).

## Token Opacity

Relying Parties (RPs) must treat the Access Token as an **opaque string**.

* **Do not attempt to decode, parse, or inspect the token structure**.
* **Do not rely on any internal claims** (e.g., `sub`, `exp`) found within the token for application logic.

While the token is technically issued as a Signed JWT (JWS), its internal structure is **intended solely for the Resource Server (Corppass)** - for internal validation and rotation without breaking client integrations.

## Token Lifecycle

* **Expiration:** The Access Token is valid for 10 minutes (600 seconds) from the time of issuance.
* **Renewal:** Once expired, the client must initiate a new Authorization Flow to obtain a new token (refresh tokens are currently not supported).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.corppass.gov.sg/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/3.-token-endpoint/access-token.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.