---
title: Server-side tokens
description: Store OAuth 2.0 tokens in CTS and return references instead of actual token data to clients
component: pingoneaic
page_id: pingoneaic:am-oauth2:server-side-tokens
canonical_url: https://docs.pingidentity.com/pingoneaic/am-oauth2/server-side-tokens.html
llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["OAuth 2.0", "Endpoints", "Storage", "Setup & Configuration"]
page_aliases: ["oauth2-guide:server-side-tokens.adoc"]
---

# Server-side tokens

The CTS token store is the authoritative source for server-side tokens. Advanced Identity Cloud returns a *reference* to the token to the client, which does not contain any of the token information. In the following example, the reference is stored in the `access_token` property:

```json
{
  "access_token": "sbQZuveFumUDV5R1vVBl6QAGNB8",
  "scope": "write",
  "token_type": "Bearer",
  "expires_in": 3599
}
```

Server-side tokens:

* Are less vulnerable to tampering attacks because clients cannot access tokens other than to introspect them.

* Are not cached in memory.

  Each time a client presents a token ID in a request, Advanced Identity Cloud checks if the token exists in the CTS token store in case it has been revoked. If it is available, Advanced Identity Cloud retrieves its information.

  Reading from and writing to the CTS token store has a performance impact.

* Can only be introspected using a call to the authorization server.