Glossary
Short, plain definitions of the terms used across the lessons, each with a link to the lesson that explains it in full.
In a lesson, a term with a dotted underline is defined here. Hover over it or move focus to it to see the definition, or follow the link to read more.
A
- Access review
A scheduled or triggered check in which a responsible person looks at access someone already has and decides whether they should keep it. It is also called certification, and it leaves a record of who decided what.
- Access token
A token that a client presents to an API to use access it has been granted, usually limited in what it allows and how long it lasts. It authorizes API calls; it does not tell the client who signed in.
- Account
A person's or application's representation inside one particular system, with whatever identifier, credentials, and settings that system uses. One identity can have many accounts: you are not your account.
- Account takeover
When an attacker gains control of someone else's account, for example through phishing or stolen credentials, and the system then treats the attacker as the owner. The attacker inherits everything the account can do.
- Agent identity
The identity of software that acts for a person while choosing its own steps, such as an AI assistant. It lets services see which agent acted and for whom, and lets the person limit or remove the agent's access without changing their own credentials.
- API
An application programming interface: a defined way for software to interact with a service. A web API offers endpoints where other programs send HTTP requests.
- Assertion
A structured statement from an identity provider about a user or a sign-in, such as who authenticated, when, and attributes like their department. The word is most associated with SAML.
- Assertion consumer service
The endpoint at a SAML service provider that receives the identity provider's response, usually as a form the browser posts. The service provider publishes its ACS URL in metadata, and the identity provider sends responses only there.
- Assurance level
A published level of confidence for a process such as identity proofing, where each higher level requires stronger evidence and checks. Levels let a claim like "we verified this person" mean the same thing from one service to the next.
- Attestation
A signed statement about a device or running process from a party the verifier already trusts, rather than from the thing itself. In WebAuthn, an authenticator's maker vouches for its model when a passkey is registered; for workloads, a cloud platform or orchestrator vouches for a running process before it receives a credential.
- Attribute
A piece of information that describes a subject, such as a name, department, or account status. Systems use attributes to show information and to make access decisions.
- Attribute-based access control
Deciding access with rules that test attributes of the subject, the resource, the action, and the context, for example allowing a download only from a company-managed device.
- Audience
The intended recipient of a token or signed message, recorded in its aud claim. A recipient should reject a token whose audience names someone else, even if its signature is valid.
- Authentication
Checking evidence that someone, or some application, controls an account, such as a password or a passkey. It establishes which account is being used, not what that account may do.
- Authenticator
Something a person controls and uses to prove control of an account, such as a memorized password, an app that generates one-time codes, or a security key. It counts only after it has been registered to that account.
- Authenticator assurance level
One of three levels, AAL1 to AAL3 in NIST SP 800-63B, that describe how strongly a sign-in shows the right person is present. AAL2 requires two factors, and AAL3 requires a phishing-resistant authenticator whose key cannot be copied off the device.
B
- Backend
The part of an application that runs on its own servers rather than in your browser or on your phone. Because users cannot inspect it, a backend can keep secrets such as a client secret.
- Base64
A way of encoding data as ordinary text characters so it can travel safely in headers, URLs, and JSON. Anyone can decode it, so it hides nothing; Base64url is a variant safe for URLs, used in JWTs.
- Bearer token
A token that works for whoever presents it: the API checks that the token is genuine and current, not who is holding it. That is why bearer tokens must be kept from being copied.
- Break-glass access
A few tightly guarded accounts or procedures that let administrators regain control when normal sign-in or approval paths fail. Every use should raise an alert and be reviewed afterward.
- Browser
The program you use to open websites, on a computer or phone. In identity exchanges it acts as a client: it sends requests, stores and returns cookies, and follows redirects between applications and sign-in services.
C
- Certificate
A signed statement that a public key belongs to a name, such as a website's hostname, for stated purposes and a limited period. A certificate authority signs it, so software that trusts the authority can connect the key to the name.
- CIBA
Client-Initiated Backchannel Authentication: an OpenID Connect flow in which a client asks the provider to authenticate a person on a separate device, such as their phone, with no browser redirect. The client then collects the result by polling, a ping or a push.
- Claim
A statement about someone or something that may or may not be true, such as a job title typed into a profile. In tokens and assertions, claims are the individual statements the issuer makes, such as which account signed in and when.
- Client
The side of a conversation that sends a request, such as your browser asking a server for a page. In OAuth, the client is the application seeking access to someone's resources, even when that application is itself a server.
- Client ID
The identifier an authorization server gives a registered client, telling the server which application is involved. It is not secret, so knowing it does not prove that a request came from that application.
- Client ID metadata document
A JSON document of a client's metadata, published at an HTTPS URL that the client then uses as its client ID. The authorization server fetches the document when the client first appears, instead of requiring registration in advance.
- Client secret
A shared secret that a confidential client uses to prove itself to the authorization server, much like a password for an application. It belongs on a backend, never in code sent to browsers or phones.
- Conditional access
Access policy that decides at sign-in or request time whether to allow, deny, or ask for more, based on conditions such as the user, the application, the device's state, location and risk.
- Confidential client
An OAuth client, typically running on a backend, that can keep a credential such as a client secret or private key protected, and so can authenticate itself to the authorization server.
- Consent
A person's agreement to the access an application is requesting, often given on a screen that explains what the application wants to do.
- Credential
The secret or key that a person or application uses to prove an account or relationship belongs to it, such as a password, a passkey, or a client secret. Unlike an identifier, it only works as evidence if its holder keeps it from others.
- Credential stuffing
An attack that takes email and password pairs leaked from one service and tries them at other services, relying on people reusing passwords.
- Cross-site request forgery
An attack in which another site makes your browser send a request you did not intend, and the receiving application treats it as yours because your session cookie came with it. Cookie settings such as SameSite reduce it by keeping the cookie off requests other sites start.
- Cross-site scripting
An attack in which a site runs script an attacker supplied inside its own pages, so the script acts with the site's privileges. It can read cookies and tokens kept where scripts can reach them and send requests as the signed-in user.
D
- Delegated access
Letting an application do a limited task with someone else's authority, such as a printing service reading your photos, without giving it your password. OAuth 2.0 is the usual framework for arranging it.
- Deprovisioning
Taking accounts and access away when they are no longer needed, for example disabling a departing employee's accounts and removing their roles and group memberships. The lessons treat it as part of provisioning.
- Digital signature
A value made with a private key that lets anyone holding the matching public key check that a message came from the key's holder and has not been changed. It proves origin and integrity; it does not hide the message.
- Directory
A shared store of information about people, groups, and other things an organization needs to look up, kept in one place so that many applications can read the same answers.
- Discovery document
A JSON document that an OpenID Provider publishes at a well-known address under its issuer, listing its endpoints, where to find its signing keys, and its supported features so clients can configure themselves from one value.
- DNS
The Domain Name System, the internet's lookup service that turns a domain such as photos.example into the address of the computer serving it. Whoever controls a name's DNS records controls where that name points.
- Domain
A name for a site or service on the internet, such as photos.example or login.cedar.example. Browsers, cookies, certificates, and passkeys all use it to decide which site they are dealing with.
- DPoP
An OAuth extension, RFC 9449, that binds tokens to a key pair the client holds. The client signs a fresh proof for each request, so a stolen token is useless without the private key.
E
- Encoding
Changing how data is represented, for example as Base64 text, so it can be stored or sent. Anyone can reverse it, so it protects nothing.
- Encryption
Transforming data so that only someone holding the right key can read it. It protects confidentiality and, unlike hashing, is designed to be reversed by the key holder.
- Endpoint
An address where a service receives requests for a particular purpose, such as an API address for albums or the authorization server's token endpoint.
- Enrollment
Registering an authenticator, such as a security key or authenticator app, to an account, so the service knows that evidence from it belongs to that account.
- Entitlement
The umbrella word for anything an account has been granted in a system: a group membership, a role, a permission, or a specific capability.
F
- Factor
A kind of authentication evidence: something you know, such as a password; something you have, such as a security key; or something you are, such as a fingerprint.
- FAPI
OpenID Foundation security profiles that fix how OAuth and OpenID Connect are combined for high-risk APIs, such as open banking. FAPI 2.0 requires choices such as PAR, PKCE and sender-constrained tokens, and conformance tests check that a deployment follows them.
- Federation
An arrangement that lets systems accept identity information from another trusted system, so an application can rely on a sign-in performed by a separate identity provider.
- FIDO2
The FIDO Alliance and W3C standards for signing in with public-key credentials: WebAuthn between a website and the browser, and CTAP between the browser and an authenticator such as a security key. Passkeys are FIDO2 credentials.
- Frontend
The part of an application that runs in front of the user, such as the code in a web page or a phone app. People using it can inspect its code, so it cannot keep secrets.
G
- Grant
In OAuth, a credential representing authorization that a client exchanges at the token endpoint for an access token, such as an authorization code. The grant type names the method, and products also call a saved connection between a person and an application a grant.
- Group
A named set of people or accounts, such as a team, so that access can be given to everyone in it at once. A group says who belongs together; a role says what a kind of work needs.
H
- Hashing
Turning data into a short, fixed-size value called a hash, in a way that cannot be reversed and where changing one character changes the result completely. Services store password hashes instead of passwords, and signatures are made over a hash.
- Header
A line of extra information sent with an HTTP request or response, such as the format the client accepts or the token it is presenting.
- HTTP
The Hypertext Transfer Protocol, the rules browsers, apps, and servers use to send requests and responses on the web.
- HTTPS
HTTP protected by TLS, so traffic is encrypted and checked for changes while it travels. It protects the connection, but does not prove that the site at the other end is honest.
I
- ID token
In OpenID Connect, a signed JWT from the provider, addressed to one client, saying which account authenticated, when, and in answer to which request. It reports a sign-in and is not used to call APIs.
- Identifier
A value that picks out one account or subject within a system, such as a username, email address, or account ID. Knowing an identifier says which account is meant, but proves nothing about who is using it.
- Identity
Who or what a system is dealing with, whether a person, an application, or a device, and the information that represents it. In governance, an identity is also the single record that represents one person across a whole organization.
- Identity proofing
A process for establishing confidence that someone is the real person they claim to be, for example by checking identity documents and confirming that the evidence belongs to the person presenting it.
- Identity provider
A service that authenticates users and tells other applications about the sign-in, so those applications never handle the users' passwords. In OpenID Connect it is called an OpenID Provider.
- Introspection
A way for an API to ask the authorization server what a token means: whether it is still active and what access it carries. APIs need it when a token is a random string that only the authorization server can interpret.
- Issuer
The party that creates and signs a token, assertion, or certificate, named in a token's iss claim. A recipient must check that the issuer is exactly the one it expected and trusts.
J
- JAR
An OAuth extension, RFC 9101, that puts the authorization request's parameters in a signed JWT called a request object. The authorization server can then tell they came from the client and were not changed in the browser.
- JARM
An OpenID Foundation extension that returns the authorization response, including the code and state, inside a JWT signed by the authorization server. The client checks the signature before it uses the code.
- JSON
A text format for structured information, written as named values inside curly braces. APIs, tokens, and discovery documents all use it.
- JSON Web Key Set
A JSON document, published at a fixed HTTPS address, that lists an issuer's current public keys so others can verify its signatures. It never contains private keys.
- JWE
The JOSE format for encrypted content, defined in RFC 7516, which only holders of the right key can read. A JWT is sent as a JWE when its claims must stay confidential, not just protected from change.
- JWS
The JOSE format for signed content, defined in RFC 7515. A signed JWT is a JWS: a header, a payload and a signature, each base64url-encoded and joined by dots.
- JWT
A JSON Web Token: a compact token made of Base64url-encoded parts that carries claims and is usually signed. Anyone holding it can decode and read the claims, so the signature shows who issued it but hides nothing.
K
- Kerberos
A ticket-based authentication protocol, used by Active Directory, in which a key distribution center issues time-limited tickets. A user presents a ticket to each service instead of sending a password.
- Key
A value that cryptography uses to sign, verify, encrypt, or decrypt data. It is either a shared secret that both sides hold or one half of a key pair.
- Key pair
A private key and a public key generated together and mathematically linked. The private key creates signatures and the public key checks them, but the private key cannot practically be worked out from the public one.
- Key rotation
Replacing a key or secret with a new one, on a schedule or after a suspected leak, usually by publishing the new key before using it and keeping the old one until everything it signed has expired.
L
- LDAP
The Lightweight Directory Access Protocol, a long-established way for applications to connect to a directory, authenticate to it, and search for or change its entries.
- Least privilege
Granting only the access a task needs, and nothing more. For powerful access, it can also mean granting it only for as long as the task takes.
- Logout token
A signed JWT that an OpenID Provider sends directly to a relying party's server to say that a person's session at the provider has ended, naming them by sub, sid, or both. The relying party validates it like an ID token and ends its own matching session.
M
- Metadata
Descriptive information that a provider, server, or client publishes about itself so other software can work with it without manual setup, such as a provider's endpoints and keys or a client's name and redirect URIs.
- Multi-factor authentication
Signing in with more than one type of factor, such as a password plus a code from an enrolled authenticator app. Two passwords are still one factor type, however many screens they appear on.
- Mutual TLS
A TLS connection in which the client also presents a certificate and proves it holds the matching private key. OAuth uses it, in RFC 8705, to authenticate clients and to bind access tokens to the client's certificate, so a copied token fails without that key.
N
- NameID
The value in a SAML assertion's subject that identifies the user to the service provider, in a declared format such as a persistent opaque identifier or an email address.
- Nonce
A random value used for one attempt only. In OpenID Connect, the client sends one in its sign-in request and checks that the same value comes back inside the ID token, showing the token answers this attempt.
O
- OAuth 2.0
A framework that lets a person give an application limited access to their resources at another service, using tokens instead of sharing their password. OAuth is about access; OpenID Connect adds sign-in.
- Open redirect
A flaw in which a service sends people on to any address it is handed, such as a return destination in a sign-in link. An attacker can use the genuine page to deliver someone to a look-alike site, so a service accepts only destinations it recognizes.
- OpenID Connect
An identity layer on top of OAuth 2.0 that lets an application sign people in with an account at another service. It adds the ID token, standard claims, and discovery to the OAuth exchange.
P
- Pairwise subject identifier
A subject identifier that an OpenID Provider calculates separately for each relying party, or each group of relying parties sharing a sector, so that two unrelated services cannot match up the same person by comparing sub values.
- PAR
An OAuth extension, RFC 9126, in which the client sends its authorization request straight to the authorization server and gets back a short-lived request_uri. The browser carries only that reference, so the parameters cannot be read or changed on the way.
- Passkey
A credential that your phone, computer or password manager creates for one website and keeps for you, unlocked with a fingerprint, face or PIN. Nothing you could type is sent, and it works only for the site it was made for, which helps it resist phishing.
- Password spraying
An attack that tries a few common passwords against many accounts, one or two attempts each, so that no single account sees enough failures to stand out.
- Percent-encoding
Writing a character as % followed by a two-character code, such as %2F for /, so a value inside an address or form body is not mistaken for part of its structure. The receiving service decodes it before use.
- Permission
A name for one action that a system can allow or refuse, such as uploading a photo or approving a payment. Roles bundle permissions together.
- Phishing
Tricking someone, usually with a message and a look-alike sign-in page, into handing over the evidence that opens their account, such as a password or a one-time code.
- Phishing resistance
A property of an authentication method that binds sign-in to the real service, so evidence entered on a look-alike site cannot be passed on and used. Passkeys have it; passwords and one-time codes do not.
- PKCE
Proof Key for Code Exchange, pronounced pixie: the client creates a secret for each authorization attempt, sends only a hash of it at the start, and proves it holds the secret when redeeming the code, so a stolen authorization code is useless to anyone else.
- PKI
Public key infrastructure: certificates, the certificate authorities that issue them, and the rules and systems that manage them, which together let software trust that a public key belongs to a name.
- Policy
The set of rules used to make access decisions, for example letting an album's owner delete photos while invited viewers may only look at them.
- Private key
The half of a key pair that its owner keeps to themselves and uses to create signatures or decrypt data. Anyone who obtains it can act as its owner.
- Prompt injection
Text in content an AI agent reads, written to look like an instruction and steer the agent into actions its user did not ask for. No agent ignores such text every time, so the services it calls must enforce limits that hold even when it is fooled.
- Protocol
An agreed set of rules for the messages two systems exchange and what each message means. HTTP, OAuth 2.0, OpenID Connect and SAML are all protocols.
- Provisioning
Creating accounts in applications, keeping their attributes and access current, and disabling them when people leave, without waiting for each person to sign in. SCIM is a standard way to send those changes.
- Public client
An OAuth client, such as code running in a browser or an app on a phone, that cannot keep a credential secret because the people using it can inspect it. It relies on protections such as PKCE instead of a client secret.
- Public key
The half of a key pair that can be shared freely. It checks signatures made with the matching private key and can encrypt data that only that private key can decrypt.
R
- Redirect
A response telling the browser to go to another address, which the browser then requests. Sign-in journeys use redirects to move the browser between an application and a sign-in service.
- Redirect URI
The address at the client where the authorization server sends the browser back with its response, such as an authorization code. It must exactly match an address registered for that client.
- Refresh token
A longer-lived credential that a client sends to the authorization server, never to an API, to get new access tokens without asking the person again.
- Relationship-based access control
Deciding access by following relationships between people and things, such as being the owner of an album or a member of a shared folder.
- Relying party
An application that accepts and relies on a sign-in from another service, the name used in OpenID Connect and for passkeys. SAML calls the same role a service provider.
- Replay
Reusing a captured message or credential, such as a token copied from a log, so that it is accepted again. Expiry, one-time values, and binding a token to a key all limit replay.
- Request
A message a client sends to a server asking it to do something, such as return a page or a photo album. On the web, a request names a method, an address, and headers.
- Resource
The thing being accessed, such as a particular photo, album, or set of data behind an API. Access decisions and OAuth scopes are always about some resource.
- Resource owner
In OAuth, the person who can authorize access to protected resources, such as you deciding whether a printing app may read your photos.
- Resource server
In OAuth, the API that holds protected resources and decides, for each request, whether the presented access token allows it.
- Response
The server's reply to a request, with a status code, headers, and often a body such as a page or JSON data.
- Revocation
Cancelling a credential, token, certificate, or authenticator before it would expire, so that it is no longer accepted. Whether every copy stops working at once depends on how services check it.
- Role
A named set of permissions that describes a kind of work, such as Picture editor. Assigning a role to someone gives them those permissions within a stated scope, such as one album.
- Role-based access control
Granting access by assigning roles, each a bundle of permissions, rather than granting permissions to people one by one.
S
- Salt
A random value stored with each password hash and mixed into the calculation, so that two people with the same password get different stored hashes. It does not need to be secret.
- SAML
The Security Assertion Markup Language, a federation standard widely used for workplace single sign-on, in which the identity provider sends the application a signed assertion about the user.
- SCIM
The System for Cross-domain Identity Management: a standard shape for users and groups and a standard set of HTTP requests for creating, changing, and disabling accounts in applications.
- Scope
In OAuth, a name for an area of access an application requests, such as photos.read; the service decides what each scope means. In role assignments, scope instead means where a role applies, such as one album.
- SD-JWT
A signed JWT whose claims are replaced by digests, with each claim's value kept in a separate disclosure. The holder sends only the disclosures it chooses, so a verifier sees just the claims it needs.
- Security key
A small physical device, plugged in or held near a phone or computer, that holds credentials and uses them to prove you have it. It is an authenticator that resists phishing.
- Sender-constrained token
A token bound to a key that the client holds, so an API accepts it only from a sender who proves possession of that key. A copied token is useless on its own.
- Separation of duties
Dividing a sensitive process so that no single person can complete it alone, for example one person adds a supplier and another approves payments to it.
- Server
A computer or program that receives requests and sends responses, such as the service storing your photos. The same program can act as a client when it calls another service.
- Service provider
SAML's name for the application that relies on an identity provider's sign-in, which OpenID Connect calls a relying party. In SCIM, the same term means the application that stores the accounts.
- Session
The ongoing connection between later requests and an earlier sign-in, so you are not asked for your password on every click. It is often tracked with a cookie holding an unpredictable session identifier.
- Session hijacking
Stealing someone's session, usually by copying its cookie or token, and using it so the attacker is treated as that person without needing their password or MFA.
- Single sign-on
Signing in once and then using several applications without entering credentials again, usually because they all rely on the same identity provider.
- SPIFFE
An open standard for workload identity. It names each workload with a URI under a trust domain, such as spiffe://printer.example/prod/render, and defines short-lived identity documents as X.509 certificates or JWTs.
- State
In OAuth and OpenID Connect, a fresh, unpredictable value the client sends with its authorization request and checks when the browser returns, tying the response to the attempt and browser session that started it.
- Status code
The three-digit number at the start of an HTTP response that says how the request went, such as 200 for success, 302 for a redirect, or 401 when authentication is needed.
- Step-up authentication
Asking someone who is already signed in for stronger evidence before a sensitive action, such as requiring a passkey to export payroll after a password sign-in.
- Subject
The person or application a request, decision, or statement is about. In tokens, the sub claim holds the issuer's stable identifier for that subject.
T
- Tenant
One organization's separate space inside an identity service that hosts many organizations, with its own accounts, applications and settings that other tenants cannot see or change. A token from one tenant must not be accepted as if it came from another.
- TLS
Transport Layer Security, the protection behind HTTPS. It encrypts traffic between two connected systems, detects changes on the way, and uses certificates so the client can confirm which server it reached.
- Token
A piece of data issued by a trusted service that a client presents as a credential, for example to call an API or to report a sign-in. Some tokens carry readable claims; others are random strings that only the issuer can interpret.
- Token endpoint
The authorization server address where clients exchange an authorization code, refresh token, or other grant for tokens, in a direct request rather than through a browser redirect.
- Token exchange
An OAuth grant, RFC 8693, in which a client trades a token it holds for a new one, usually for another audience, with narrower access, or acting for someone. It lets a service call the next service without passing the original token along.
U
- Unix time
A count of seconds since midnight UTC on 1 January 1970. JWT claims such as exp and iat use it, under the name NumericDate.
- URL
A web address, such as https://photos.example/api/albums/42?limit=10. It names how to connect (https), the domain, the path to a particular page or resource, and any extra parameters after the question mark.
- UserInfo endpoint
An OpenID Provider endpoint that returns claims about the signed-in person to a client presenting an access token. Its sub must match the ID token's before the client uses anything it returns.
V
- Verifiable credential
A credential that an issuer signs and gives to a holder, who can later present it to any verifier. The verifier checks the issuer's signature without contacting the issuer each time.
W
- Wallet
An application that holds a person's verifiable credentials and the keys that go with them, receives credentials from issuers, and presents them to verifiers when the person agrees.
- WebAuthn
The W3C browser API that lets a website register and use public-key credentials, such as passkeys and security keys. The site sends a challenge, and the authenticator signs it with a key scoped to that site.
- Workload identity
An identity that belongs to software that runs and acts without a person directing each request, such as a service, a scheduled job or a pipeline step. It names the logical workload, not one running copy, and each copy holds its own credential.
- Workload identity federation
Letting a workload that runs elsewhere, such as a pipeline job, use a signed token from an issuer you trust instead of a stored key. The token's issuer, audience, subject and other claims must match conditions you set before it is exchanged for a credential.
Z
- Zero trust
A security approach that grants nothing because a request comes from inside a network. Each request is checked against identity, device and context, with least privilege and continued verification.