The security of API tokens extends far beyond cryptographic signatures. Even a properly signed token using a strong algorithm can be stolen and abused because the signature only prevents modification, not theft. Once an attacker obtains a valid access token, the server typically cannot distinguish the legitimate user from the attacker presenting the stolen credentials.
Stage 1: Token Issuance
Security begins at creation. Public clients such as single-page applications and mobile apps must use the Authorization Code Flow with PKCE rather than legacy implicit flows. PKCE binds the authorization request to a client-generated code_verifier, preventing an attacker who intercepts only the authorization code from completing the exchange. Confidential backend services should use the client_credentials grant with short-lived tokens and regularly rotated secrets stored in dedicated secret-management systems.
Access tokens for browser applications should expire within 5 to 15 minutes. Refresh tokens may live longer, supporting sliding sessions with an absolute maximum lifetime to force re-authentication. Endpoints such as /login, /token, and /oauth/authorize require strict rate limiting that considers account identifiers, device signals, and IP ranges, not just single addresses. Confidential clients can further strengthen authentication by presenting short-lived signed JWT assertions instead of static client secrets.
Stage 2: Client-Side Storage
Storing tokens in localStorage or sessionStorage exposes them to any JavaScript running on the page, including code injected through XSS, compromised npm packages, or supply-chain attacks. HttpOnly cookies marked Secure and SameSite=Lax significantly reduce direct token extraction. The Backend-for-Frontend (BFF) pattern offers even stronger protection by keeping OAuth tokens on the server; the browser receives only an opaque session identifier stored in an HttpOnly cookie. Session data can be maintained in Redis or another secure backend store, enabling centralized rotation, revocation, and monitoring.
Stage 3: Transmission and Usage
Bearer tokens are commonly sent in the Authorization header and require TLS. Cookie-based authentication simplifies client code but necessitates additional CSRF defenses such as synchronizer tokens or strict Origin/Referer validation. Sensitive operations should combine multiple layers rather than relying on any single browser flag.
By following short-lived tokens, atomic refresh-token rotation, HttpOnly cookies or BFF architecture, and comprehensive revocation capabilities, applications can substantially limit the impact of token compromise.
