← Back to glossary
🪪

Security Token

Authentication

Multi-Factor Authentication (MFA) Single Sign‑On (SSO) Two-Factor Authentication (2FA) TOTP (Time‑Based One‑Time Password)

Authentication factor/token used to assert identity; may be hardware-backed or software-based.

Definition

Security tokens include OTP generators (TOTP/HOTP), hardware security keys (FIDO2/WebAuthn), smart cards, and app-based push approvals. Properties vary (phishing resistance, replay protection, device binding).

In plain English Authentication factor/token used to assert identity; may be hardware-backed or software-based.

Why this matters

Why it matters: Strong tokens reduce credential compromise impact and can provide phishing-resistant authentication when using hardware-backed standards.

Example

Example: Use a FIDO2 security key for admin accounts and fall back to TOTP only when necessary.