Token

Basic and Bearer Token Auth

Learn how HTTP Basic Authentication and Bearer Token Authentication work, and how to configure each correctly in Postman's Authorization tab.

Access Tokens and JWTs

Access tokens are the credentials a client presents to a resource server, and JWTs are the most common self-contained format for encoding them.

Refresh Tokens

Refresh tokens let a client obtain new access tokens without forcing the resource owner to re-authenticate, and how they're issued and rotated is central to OA…

Securing Token Endpoints

Hardening the OAuth token endpoint with strong client authentication, brute-force resistance, refresh token rotation, and sender-constrained tokens.

The Refresh Token Grant

Refresh tokens let a client obtain new access tokens without repeating the full authorization flow, keeping short-lived access tokens practical for long-runnin…

Token Introspection and Revocation

Introspection lets a resource server ask the authorization server whether a token is still valid, and revocation lets a client or user proactively kill a token…

Token Storage Best Practices

Where and how a client stores access and refresh tokens is often the deciding factor in whether an OAuth 2.0 integration is actually secure in practice.

Building a Simple Token Contract

A hands-on walkthrough of writing an ERC-20 token in Solidity, from the standard's required interface to a minimal from-scratch implementation and the safer Op…

ERC-20 Token Standard

The interface and mechanics behind fungible tokens on Ethereum, covering core functions, the approve/allowance pattern, events, and safe implementation.

Session vs Token Authentication

Compare stateful session-based authentication with stateless token-based authentication and when to use each approach.