Skip to main content
All glossary terms

Credentials & security

Capability token

A capability token is a credential that conveys authority to perform a defined action on a resource. Systems can limit that authority by scope, audience, use count, or expiry; the token’s actual capabilities are determined by how the receiving service validates it.

Also known as capability credential.

Why it matters in practice

Because possession may grant access, a capability token should be treated as a secret and protected from logs, referrers, and unintended recipients. Narrow scope and revocation reduce some exposure. A token is not safe merely because it is called a capability, and it does not replace the service’s authorization checks.

Example

A recipient presents a scoped token to access one shared test proxy, while unrelated account actions remain unavailable.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.