---
title: "Token"
source: https://dev.pageseeder.com/reference/glossary/token.html
description: "A random string generated by PageSeeder for authentication and authorization, including OAuth access tokens, security tokens for user account operations, and authorization codes."
last_updated: 2026-09-08T13:57:02+10:00
tokens: ~423
---

# Token

A random string generated by PageSeeder and used for authentication or authorization depending on the type of token used.

## Access token

Access tokens are issued for [OAuth clients](/reference/glossary/oauth_client.md) on behalf of a member, to access their account through the API. The OAuth client configuration determines which OAuth authorization flow clients can use to get an access token as well as how long the token is valid for.

PageSeeder implements the following standard OAuth endpoints:

- `[Server URL]/ps/oauth/authorize` : gets an authorization code.
- `[Server URL]/ps/oauth/token` : gets an access token.

## Built-in security tokens

Security tokens are always associated with a specific user account.

| Type | Purpose | Default lifetime |
| --- | --- | --- |
| `remember-me` | Remember me cookie used for sign-in | 90 days |
| `activate-member` | Account activation  | 2 days |
| `change-email` | Change of email address | 12 hours |
| `reset-password` | Reset password flow | 12 hours |

End users can list and revoke any persistent tokens associated with them from their **security settings and password** page.

The expiration of security tokens can be configured in the [organization config](/guide/configuration/organization_customization.md). For example:

```xml
<security>
  <token type="activate-member" expiration="P90D" />
  <token type="reset-password" expiration="P2DT12H" />
</security>
```

### Other types of token

- [Authorization codes](/reference/glossary/authorization_code.md) – are special types of tokens that are short-lived and single-use.
- [ID Token](/reference/glossary/id_token.md) – carries identity information about a user.