A token anyone can carry
Access tokens are bearer tokens: whoever presents one gets the access. That's simple, works everywhere, and means a token copied out of a log, a browser's storage, or a compromised proxy works immediately from anywhere.
The service has no way to notice, because a replayed token is byte-for-byte the token it issued.
Add what makes a copied token useless on its own.
Components — tap one, then tap a slot on the diagram
?If a token can be copied out of its runtime and replayed elsewhere with no extra secret, theft is silent and total.
Outside every boundary: Resource server, Whoever copied it (token only; FAILED: no key), Real client (holds a private key), an empty slot for the sent with every request Connections: Real client calls sent with every request — signs this request (step 1) Whoever copied it must NOT reach sent with every request — can't produce one sent with every request calls Resource server — token + proof (step 2)
Resource server
Whoever copied ittoken onlyno key
Real clientholds a private key