Auth icons

The 123 auth icons in Security, described

Access deniedaccess-deny

Access denied — you may not come through, permission refused.

Access grantedaccess-grant

Access granted — you may come through, permission allowed and the door open.

Access requestaccess-request

A ticket with a plus on it — someone asking to be let in.

Access reviewaccess-review

A clipboard with a key on it — who still has what, gone over on a schedule.

Token scopeaccess-token-scope

A ticket with a funnel on it — what this token is allowed to reach, and no more.

Account lockoutaccount-lockout

A padlock with a person in it — an account shut after too many wrong tries.

SAML assertionassertion-saml

A ticket with lines of text on it — the signed statement that a user is who they say.

Attribute-based accessattribute-based

A padlock with a tag in it — access decided by what is true of the user, not just their role.

Audience claimaudience-claim

A ticket with two points on it — who a token is meant for.

Authenticationauth

Authentication — proving who you are with a login, a key or an identity provider.

Authorisation codeauthorisation-code

A ticket with a hash on it — the short code traded for a token.

Biometricbiometric

Biometric — proving it is you by what you are, a fingerprint or a face.

Break glassbreak-glass

Break glass — the emergency access you hope stays sealed until it is truly needed.

Client secretclient-secret

A ticket with a key on it — what an application shows to prove it is itself.

Concurrent sessionsconcurrent-session

The wide machine with two people signed in — the same account, in two places.

Consent screenconsent-screen

A window with a title and one button — the page that asks the user to allow it.

Data residencydata-residency

Data residency — the data lives in this region by law and may not leave it.

Delegate accessdelegate-access

A person with an arrow across the chest — rights handed on to someone else.

Device code flowdevice-code-flow

A phone with a code on it — sign in on another device by typing what this one shows.

Device trustdevice-trust

A phone with a check on it — a device known and allowed before the user is.

Directory syncdirectory-sync

A folder with an arrow looping back — users and groups copied over from the directory.

Dormant keydormant-key

An upright key, a Z in its bow — a credential that has not been used in a long time.

Entitlemententitlement

A ticket with a coin on it — what a user is owed by virtue of who they are.

Face IDface-id

Face ID — your face is the key, biometric unlock by scanning who you are.

Geo keygeo-key

A location pin with a key in its head — a credential that only works from one place.

Geofencegeofence

A location pin beside a shield — access allowed only inside a geographic boundary.

Grantgrant

An upright key, a plus in its bow — grant a permission or a new scope.

Group membershipgroup-membership

A folder with a person in it — the groups a user is filed under.

ID cardid-card

A card with a person and their details — an identity card or service account.

ID tokenid-token

A ticket with a person on it — the token that says who just signed in.

Identityidentity

Identity — who somebody is, their profile and details on an ID card.

Idle timeoutidle-timeout

A ring with a Z in it — a session that ends when nobody has touched it for a while.

Impersonateimpersonate

Two heads overlapping on one pair of shoulders — acting as another user.

Implicit flowimplicit-flow

A ticket with an arrow straight through it — the token handed over with no code step.

Issuer claimissuer-claim

A ticket with a seal on it — who minted the token.

Just-in-time accessjust-in-time-access

Just-in-time access — the key exists only for the hour it is needed.

JWTjwt-token

A ticket ruled into three parts — header, payload and signature.

Key alertkey-alert

An upright key, an alert in its bow — a credential that needs attention.

Key blockedkey-blocked

An upright key, a stop square in its bow — a credential blocked from any further use.

Key checkpointkey-checkpoint

An upright key, a flag in its bow — the point at which a credential is checked.

Key eventkey-event

An upright key, a bolt in its bow — a credential used, created or revoked.

Key filterkey-filter

An upright key, a funnel in its bow — filter records by which credential was used.

Key listkey-list

An upright key, list rows in its bow — the credentials issued to an account.

Key lookupkey-lookup

A magnifying glass with a key inside — look up which credential this is.

Key revokedkey-revoked

An upright key, an X in its bow — a credential that has been revoked.

Key runkey-run

An upright key, a play triangle in its bow — a run started with a specific credential.

Key sharekey-share

An upright key, an arrow in its bow — share a credential with someone else.

Key shieldkey-shield

A shield with a key inside — a credential kept under protection.

Key tagkey-tag

A label with a key inside — a named credential you can tell apart from the rest.

Key upgradekey-upgrade

An upright key, a double chevron rising in its bow — a credential promoted to a higher scope.

Key usagekey-usage

An upright key, a rising line in its bow — how much a credential is being used.

Key vaultkey-vault

The vault door with a key inside — credentials kept locked away.

Key verifiedkey-verified

An upright key, a check in its bow — a credential that has been verified.

Least privilegeleast-privilege

An upright key, a minus in its bow — grant only the access a task needs.

Legal holdlegal-hold

A legal hold — nothing here may be deleted, frozen by court order.

Lock alertlock-alert

A padlock with an alert on its body — a lock that needs attention.

Locked filterlocked-filter

A padlock with a funnel on its body — a filter that users cannot remove or change.

Locked goallocked-goal

A trophy with a padlock in its bowl — a goal that cannot be changed once set.

Locked listlocked-list

A padlock beside a list — a list only some people may see or change.

Locked triggerlocked-trigger

A padlock with a bolt on its body — a trigger only the right people can fire.

Log inlogin

Log in — come in, sign in with your credentials and arrive at your account.

Log outlogout

Log out — leave, sign out of your account and end the session.

Log out everywherelogout-all

A door with two arrows leaving through it — every session ended at once.

Machine identitymachine-identity

A ticket with a square on it, not a face — an identity that belongs to a workload.

Magic linkmagic-link

A key with a point and a line on it — a sign-in sent as a link to click.

Multi-factormfa

Multi-factor authentication — two proofs instead of one, a second factor on a device.

MFA pushmfa-push

MFA push — approve the sign-in on the phone in your hand as the second factor.

Nonce checknonce-check

A ticket with a check on it — a value used once, and seen to match.

OAuthoauth

OAuth — somebody else's key lent to you, a delegated grant of access.

One-time passwordotp

A one-time password — a six-digit code that works once and then expires.

Passkeypasskey

A passkey — the device itself is the key, passwordless sign-in with WebAuthn.

Permissionpermission

Permission — you are allowed to do this, access granted by a policy.

Grant permissionpermission-grant

Grant permission — from now on you may, access allowed and approved.

Permission setpermission-set

A padlock with a list in it — the permissions that travel together.

PKCEpkce

A ticket with a lock on it — the code flow with a proof key, so the code alone is useless.

Policy labelpolicy-label

A label with a shield inside — a tag that carries a security policy with it.

Policy listpolicy-list

A shield beside a list — the policies and rules that apply to this resource.

Policy scopepolicy-scope

A shield held between brackets — the scope a policy applies to.

Private bookmarkprivate-bookmark

A bookmark with a padlock inside — a bookmark hidden from everyone but you.

Private searchprivate-search

A magnifying glass with a padlock inside — a search nobody else can see.

Privilege escalationprivilege-escalation

An upright key, an arrow climbing in its bow — privileges escalating beyond what was granted.

Protected checkpointprotected-checkpoint

A flag flown big, a shield on its banner — a checkpoint that cannot be tampered with.

Protected goalprotected-goal

A shield with a flag inside — a goal guarded from interference or tampering.

Role-based accessrbac

Role-based access control — what a kind of person may do, granted by role.

Recovery coderecovery-code

A padlock with a hash in it — the code kept aside for when the second factor is lost.

Refresh rotationrefresh-rotation

A ticket with an arrow looping back — a refresh token replaced each time it is used.

Remove lockremove-lock

A padlock with a minus on its body — take a lock off and release it.

Remove policyremove-policy

A policy sheet with a minus — take a policy away from the set.

Rolerole

A role — what this person or account is here to do, a badge that carries permissions.

Role assignmentrole-assignment

A person with a tag on the chest — the role a user has been given.

Saved keysaved-key

An upright key, a bookmark in its bow — a credential kept for reuse in future runs.

Scope denyscope-deny

A clipboard with a funnel struck through — a scope the application asked for and did not get.

Scope grantscope-grant

A clipboard with a funnel on it — an application allowed this much of a user's account.

Scoped tokenscoped-token

A token pill held between brackets — an access token limited to one scope.

Secret blocksecret-block

A key held between brackets — a secret kept inside a code block.

Segregation of dutiessegregation-of-duties

A ticket with a divider and a person on each side — no one person holds both halves.

Service accountservice-account

A service account — a user that is a program, a machine identity for automation.

Service principalservice-principal

A person with a square where the heart would be — an account that is not a person.

Sessionsession

A session — signed in for now, an active window of use until you leave.

Session cookiesession-cookie

A cookie with a bite out of it and its chips — the small thing the browser sends back to say it is still you.

Session fixation guardsession-fixation-guard

A padlock with a pin in it — a new session id issued at login, so a planted one is useless.

Revoke sessionsession-revoke

A person with a cross on the chest — signed out whether they liked it or not.

Session timeoutsession-timeout

A ring with an hourglass in it — a session that ends when its time runs out.

Session tokensession-token

A session token — the opaque bearer or cookie that proves it is still you.

Short-lived tokenshort-lived-token

A short-lived token — good for minutes on purpose, then it expires.

Single sign-onsso

Single sign-on — one key that opens every door, federated login.

SSO sessionsso-session

A ticket with two rings tied together — one sign-in that opens several apps.

Step-up authstep-up-auth

A key with a staircase on it — a stronger check asked for before a sensitive action.

Subject claimsubject-claim

A ticket with a tag on it — the id of who the token is about.

Tenant isolationtenant-isolation

Two boxes with a wall between them — one customer's data kept from another's.

Time locktime-lock

A timer dial with a shield on its face — access that only opens during a window.

Token authtoken-auth

Token auth — the bearer string in a header that vouches for you.

Token exchangetoken-exchange

A ticket with an arrow pointing both ways — one token swapped for another.

Token expirytoken-expiry

A key with a clock in its head — a credential that expires after a while.

Token introspectiontoken-introspect

A ticket with a lens on it — the server asked what a token really holds.

Revoke tokentoken-revoke

A ticket with a cross on it — a token that no longer opens anything.

Unlockunlock

Unlock — it is open, access granted and the lock released for you.

User consentuser-consent

User consent — asked first, and the person said yes before anything happened.

User deprovisioninguser-deprovision

A person with a minus on the chest — an account closed and its access taken back.

User provisioninguser-provisioning

A person with a plus on the chest — an account created and given its first access.

Vaultvault-secret

A vault — behind the dial, the secrets and keys that matter most.

Window lockwindow-lock

A window with a padlock inside — a page that requires sign-in.

Workload federationworkload-federation

A ticket with one line splitting into two — an outside identity accepted here.

In code, each is one import — import { AccessDeny } from "@iconmind/react/icons/access-deny" — and the same name in Vue, Svelte, Solid, Preact, React Native, Astro, Blade and Flutter.

Narrow it by tag