A county mobile permitting app obtains short-lived access tokens from an identity service instead of embedding long-lived passwords in the client binary. Which authentication pattern is the team applying?
Select an answer to reveal the explanation.
Short Explanation
Imagine handing the app a temporary visitor badge instead of engraving the master key into the phone. Short-lived tokens get checked and expire, so a stolen binary is far less useful than a password baked into the build. That is the whole idea behind token-based auth for mobile clients.
Full Explanation
Token-based authentication patterns issue time-bounded credentials from an identity provider so mobile and API clients avoid embedding static long-lived passwords. Short lifetimes and refresh flows limit exposure if a device or package is compromised. Hard-coded database secrets, never-expiring tokens, and permanent owner roles contradict least privilege and credential hygiene. Cloud+ IAM objectives cover API and SDK access using tokens rather than embedded static passwords.