Token lifecycle is the full management process for a security token, from issuance to use, rotation, expiration, and revocation. It applies to access tokens, refresh tokens, and federation assertions used in SSO, cloud services, and APIs. The lifecycle defines when a token becomes valid, how long it can be presented, and when it must be replaced or withdrawn.
This matters because a token often acts as proof of identity or authorization. If an attacker steals a valid bearer token, they may be able to replay it until it expires or is revoked. Defenders reduce that risk with short token lifetimes, refresh-token rotation, audience and client checks, secure storage, and rapid revocation when suspicious activity is detected. A well-managed lifecycle limits the damage from theft, replay, and stale credentials.