Ephemeral authorization tokens from partner tokens

Abstract

In a system that controls access to resources via tokens, a system includes an application that generates ephemeral authorization tokens from partner tokens, to increase confidentiality and security, in embodiments. Responsive to a request, received by an application provider, for a protected resource, a federated ID/authorization provider is caused to receive a request for access/ID tokens that the ID/authorization provider provides (in any of various ways) to the application. The application validates and stores the tokens, nests the access/ID tokens within an ephemeral token document having a unique ID and shortened expiration, encrypts the nested ephemeral token using at least resource-specific encryption and causes the encrypted nested token to be sent to the protected resource provider that decrypts and validates the ephemeral token, causes the Access/ID token(s) within the ephemeral token to be validated, and provides the protected resource for valid tokens.