> For the complete documentation index, see [llms.txt](https://docs.corppass.gov.sg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.corppass.gov.sg/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/3.-token-endpoint/access-token.md).

# Access Token

The **Access Token** is a short-lived credential issued by Corppass after a successful authorization code exchange. It is used to authorize access to protected resources, such as the [Userinfo Endpoint](/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/4.-userinfo-endpoint.md).

Unlike traditional Bearer tokens, this token is **Sender-Constrained**. It is cryptographically bound to the DPoP private key used during the token exchange request.

## Token Usage

To access a protected endpoint, the client must present the Access Token in the `Authorization` header using the `DPoP` scheme (not `Bearer`).

The request must also include a DPoP Proof in a separate header. This proof verifies that the client making the request holds the same private key that was used to request the token.

```http
GET /<resource-endpoint>
Authorization: DPoP eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
DPoP: <signed-DPoP-proof>
```

For a complete code sample showing how to construct the request headers and the accompanying DPoP proof, refer to [Userinfo Endpoint](/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/4.-userinfo-endpoint.md).

## Token Opacity

Relying Parties (RPs) must treat the Access Token as an **opaque string**.

* **Do not attempt to decode, parse, or inspect the token structure**.
* **Do not rely on any internal claims** (e.g., `sub`, `exp`) found within the token for application logic.

While the token is technically issued as a Signed JWT (JWS), its internal structure is **intended solely for the Resource Server (Corppass)** - for internal validation and rotation without breaking client integrations.

## Token Lifecycle

* **Expiration:** The Access Token is valid for 10 minutes (600 seconds) from the time of issuance.
* **Renewal:** Once expired, the client must initiate a new Authorization Flow to obtain a new token (refresh tokens are currently not supported).