Identity and API Security Glossary: OAuth, SAML, JWT Terms

Terms are listed alphabetically. Where a term comes from a specific standard, the definition names it.

ABAC (attribute-based access control): An authorization model that decides access from attributes of the subject, the resource, the action and the environment, evaluated against policies. More
Access token: A credential an OAuth client presents to a resource server to call an API. It may be an opaque string or a JWT, and it should be short-lived.
Assertion: A signed statement from an identity provider about a subject, such as who they are and how they authenticated. SAML assertions are XML; JWTs play the same role in OpenID Connect.
Audience (aud): The intended recipient of a token or assertion. A receiver must reject a token whose audience does not include it.
Authentication: Verifying that a user or system is who it claims to be, for example with a password plus a second factor, a passkey or a client certificate. More
Authorization: Deciding what an authenticated subject is allowed to do. OAuth delegates authorization to clients; RBAC and ABAC decide it inside applications. More
Authorization code: A short-lived, single-use code an OAuth authorization server returns to the client's redirect URI, which the client exchanges for tokens at the token endpoint.
Authorization server: The OAuth component that authenticates the user, obtains consent and issues access tokens, refresh tokens and, with OpenID Connect, ID tokens.
Bearer token: A token that grants access to whoever holds it, defined for OAuth in RFC 6750. Sender-constrained tokens such as DPoP and mTLS-bound tokens reduce the risk of theft.
Claim: A name and value pair stating something about a subject, such as sub, email or groups. JWT payloads and SAML attribute statements carry claims.
Client credentials grant: An OAuth grant in which a client authenticates as itself, with no user involved, to get an access token for machine-to-machine calls.
CSRF (cross-site request forgery): An attack that makes a victim's browser send a request the victim did not intend. In OAuth, the state parameter and PKCE stop forged authorization responses.
DPoP: Demonstrating Proof of Possession (RFC 9449): the client signs a small JWT with its own key on every request so a stolen access token is useless without that key.
Entitlement: A specific permission granted to an identity, such as a role, group membership or right to approve a payment. Entitlement management tracks and governs them. More
Federation: A trust arrangement in which an application accepts identities asserted by an external identity provider, so users sign in once with their home account. More
HSTS: HTTP Strict Transport Security (RFC 6797): a response header that tells browsers to use only HTTPS for a host for a set period. More
ID token: The OpenID Connect token, always a JWT, that tells a client who the user is (sub), who issued it (iss), who it is for (aud) and when the user authenticated.
Identity provider (IdP): The system that authenticates users and issues assertions or tokens about them to relying parties or service providers.
JWE: JSON Web Encryption (RFC 7516): an encrypted token in five dot-separated parts. Only the holder of the right key can read its contents.
JWK and JWKS: A JSON Web Key (RFC 7517) is a public or private key in JSON. A JWK Set, often published at a jwks_uri, lists the keys used to verify tokens.
JWS: JSON Web Signature (RFC 7515): signed content in three dot-separated parts. Most JWTs are JWS objects, readable by anyone, tamper-evident to the verifier.
JWT (JSON Web Token): A compact token format (RFC 7519) made of a base64url-encoded header, payload of claims and signature, separated by dots. More
MFA (multi-factor authentication): Authentication that combines two or more factor types: something you know, something you have, something you are. Phishing-resistant MFA uses FIDO2 or smart cards.
Mutual TLS (mTLS): TLS in which both sides present certificates. RFC 8705 uses it for OAuth client authentication and to bind access tokens to a client certificate.
Nonce: A random value the OpenID Connect client sends in the authorization request and checks in the ID token, which stops a captured ID token from being replayed.
OAuth 2.0: The IETF authorization framework (RFC 6749) for issuing limited access tokens to clients. OAuth 2.1 is a draft that consolidates its security best practice. More
OpenID Connect (OIDC): An identity layer on OAuth 2.0, finalized by the OpenID Foundation in 2014, that adds ID tokens, a UserInfo endpoint and discovery.
PAR: Pushed Authorization Requests (RFC 9126): the client posts its authorization parameters directly to the server and sends the browser only a short reference.
Passkey: A FIDO2/WebAuthn credential, a key pair bound to a website, that replaces passwords and resists phishing because the browser checks the origin.
PDP, PEP, PIP and PAP: XACML's architecture: the policy decision point evaluates requests, the enforcement point applies decisions, the information point supplies attributes and the administration point manages policies.
PKCE: Proof Key for Code Exchange (RFC 7636): the client sends a hash of a random code_verifier with the authorization request and proves possession of the verifier when it redeems the code. More
Provisioning: Creating, updating and removing user accounts and access in target systems, ideally automatically from an authoritative source. More
RBAC (role-based access control): An authorization model that grants permissions to roles and assigns roles to users. Simple to audit, but roles tend to multiply over time.
Redirect URI: The address where an authorization server sends the browser back with a code or error. It must be registered in advance and matched exactly.
Refresh token: A longer-lived credential a client uses at the token endpoint to get new access tokens without sending the user back through sign-in.
Relying party (RP): An application that relies on an identity provider to authenticate its users. SAML calls it a service provider; OpenID Connect calls it a relying party or client.
Resource server: The API that accepts access tokens and serves protected resources after checking the token's validity, audience and scope.
SAML 2.0: The OASIS Security Assertion Markup Language standard (2005) for exchanging XML authentication and attribute assertions, mostly for browser SSO. More
SCIM: System for Cross-domain Identity Management (RFC 7643, RFC 7644): a JSON schema and REST API for provisioning users and groups. More
Scope: An OAuth parameter naming the access a client asks for, such as read:invoices or openid email. The token's scope should be the minimum needed.
Service provider (SP): In SAML, the application that receives and validates assertions from an identity provider.
Single sign-on (SSO): Signing in once to an identity provider and then reaching many applications without signing in again.
State parameter: An opaque value the OAuth client sends with the authorization request and checks on return, tying the response to the browser session that started it. More
Token exchange: An OAuth extension (RFC 8693) for trading one token for another, for example to call a downstream API on a user's behalf with a narrower audience.
Token introspection: An endpoint (RFC 7662) that lets a resource server ask the authorization server whether a token is active and what it allows.
XACML: The eXtensible Access Control Markup Language, an OASIS standard (version 3.0 in 2013) for writing and evaluating attribute-based authorization policies. More
Zero trust: A security approach that treats no network location as trusted and evaluates each request on identity, device health and context, as described in NIST SP 800-207.