Token issuance is the process of creating OAuth2 or OpenID Connect tokens that represent an authenticated identity for downstream systems. It is narrower than identity management because it focuses on brokered credentials and session flow, not user lifecycle, access policy, or application authorization.
Expanded Definition
Token issuance is the controlled creation of OAuth 2.0 or OpenID Connect tokens that let an authenticated principal act on behalf of an identity in downstream systems. In NHI security, the term matters because the token is the brokered credential, not the underlying account, and the issuance event often determines scope, lifetime, audience, and assurance. That makes token issuance operationally distinct from user onboarding, application authorization, and broader identity governance.
Definitions vary across vendors on whether token issuance includes refresh-token rotation, token exchange, or only the original access-token minting step. For governance purposes, NHI Management Group treats the term as the moment a security boundary is crossed and a machine-readable credential is created for use outside the authentication system. The standards baseline is reflected in the OAuth 2.0 framework and the OpenID Connect model, where claims and token lifetimes shape downstream trust.
The most common misapplication is treating token issuance as a harmless implementation detail, which occurs when teams separate issuance from policy, logging, and revocation design.
Examples and Use Cases
Implementing token issuance rigorously often introduces tighter lifecycle controls and more coordination between identity, platform, and application teams, requiring organisations to weigh short-lived, auditable credentials against added integration and revocation complexity.
- An API gateway mints an access token after federated authentication, then constrains audience and expiration before the token reaches a microservice.
- A CI/CD pipeline exchanges a workload identity for a short-lived token to retrieve deployment secrets from a vault, reducing static credential exposure. See the Guide to the Secret Sprawl Challenge.
- An agentic workflow issues delegated tokens to a tool-using AI agent so the agent can call approved services without inheriting broad human permissions.
- A SaaS integration uses refresh-token rotation and scoped access tokens to limit blast radius if the integration endpoint is compromised.
- A mobile app requests an OpenID Connect ID token for session establishment, while a separate access token authorises backend API calls under distinct claims.
For practical incident patterns, the Salesloft OAuth token breach shows how issued tokens become the real attack asset once a trusted integration is abused, and the OpenID Connect Core specification clarifies how token types are supposed to be separated by function.
Why It Matters in NHI Security
Token issuance is where NHI security becomes measurable. If tokens are over-scoped, long-lived, or inadequately bound to the intended workload, compromise of one application can become compromise of many downstream services. NHIMG research shows that 44% of NHI tokens are exposed in the wild, being sent or stored across collaboration platforms, tickets, and code commits, which means issuance decisions must assume leakage is possible rather than exceptional.
Good issuance design reduces blast radius through short lifetimes, audience restriction, token binding where available, and immediate revocation paths. It also supports governance by making each issued token attributable to a specific workload, purpose, and time window. The NIST Cybersecurity Framework 2.0 reinforces this need by tying identity assurance to access control outcomes, while the Guide to the Secret Sprawl Challenge illustrates how token and secret proliferation often begins with weak issuance practices.
Organisations typically encounter token issuance as a critical problem only after an integration compromise, at which point revocation, scope review, and issuance telemetry become operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Covers issuance, overprivilege, and lifecycle risks for non-human identities. |
| NIST CSF 2.0 | PR.AC-4 | Access permissions and identity proofing outcomes depend on safe token issuance. |
| NIST SP 800-63 | AAL2 | Authenticator strength and federation assurance affect how tokens are minted and trusted. |
| NIST Zero Trust (SP 800-207) | PA | Zero trust relies on per-request, context-aware credential issuance and validation. |
| OWASP Agentic AI Top 10 | A1 | Agentic systems depend on delegated credentials that are frequently issued and abused. |
Design token issuance to support continuous verification, limited audience, and rapid revocation.
Related resources from NHI Mgmt Group
- How should security teams apply runtime authorization to token issuance in multi-application environments?
- What should IAM teams do when token issuance must support humans, service accounts, and AI agents?
- How should IAM teams govern token issuance authorisers in production?
- What breaks when organizations treat OAuth token issuance as the final control?
