Token icons

The 29 token icons, described

Token scopeaccess-token-scope

A ticket with a funnel on it — what this token is allowed to reach, and no more.

API keyapi-key

An API key — the secret string that proves a request comes from you.

SAML assertionassertion-saml

A ticket with lines of text on it — the signed statement that a user is who they say.

Audience claimaudience-claim

A ticket with two points on it — who a token is meant for.

Authorisation codeauthorisation-code

A ticket with a hash on it — the short code traded for a token.

Chipchip

A chip — a small labelled pill you can pick, a filter or a token.

Client secretclient-secret

A ticket with a key on it — what an application shows to prove it is itself.

Crypto coincrypto-coin

An eight-sided coin with a bolt in it — a coin that lives on a network.

CSRFcsrf

CSRF — a request the browser sends with your session that you never asked for.

CSRF tokencsrf-token

A panel with a coin in it — the token a form carries to prove it came from this site.

Countergame-token

The piece you move round.

ID tokenid-token

A ticket with a person on it — the token that says who just signed in.

Implicit flowimplicit-flow

A ticket with an arrow straight through it — the token handed over with no code step.

Issuer claimissuer-claim

A ticket with a seal on it — who minted the token.

JWTjwt-token

A ticket ruled into three parts — header, payload and signature.

MCP OAuthmcp-oauth

MCP OAuth — the server proves who may call it with a token from an authorisation flow.

Progress tokenmcp-progress-token

The rack with a bar in it — the token a long request reports its progress against.

Nonce checknonce-check

A ticket with a check on it — a value used once, and seen to match.

OAuthoauth

OAuth — somebody else's key lent to you, a delegated grant of access.

PKCEpkce

A ticket with a lock on it — the code flow with a proof key, so the code alone is useless.

Refresh rotationrefresh-rotation

A ticket with an arrow looping back — a refresh token replaced each time it is used.

Refresh tokenrefresh-token-api

A token pill inside the loop — trade it in and the session quietly starts over.

Scoped tokenscoped-token

A token pill held between brackets — an access token limited to one scope.

Secretsecret

A secret — a credential, token or key that only the system should ever know.

Subject claimsubject-claim

A ticket with a tag on it — the id of who the token is about.

Token exchangetoken-exchange

A ticket with an arrow pointing both ways — one token swapped for another.

Token expirytoken-expiry

A key with a clock in its head — a credential that expires after a while.

Token introspectiontoken-introspect

A ticket with a lens on it — the server asked what a token really holds.

Revoke tokentoken-revoke

A ticket with a cross on it — a token that no longer opens anything.

In code, each is one import — import { AccessTokenScope } from "@iconmind/react/icons/access-token-scope" — and the same name in Vue, Svelte, Solid, Preact, React Native, Astro, Blade and Flutter.

Tags these icons also carry