---
title: Using the access token
description: "Call the product's API with the access token, name the target in the product's own header, and never read targets from the token."
---

The access token is what a Zev product accepts from your app. Send it to
**the product's API**, never to ZevAuth.

```bash
# ZevCloud: the target is a team, named in x-team-id.
curl https://api.zevcloud.net/v1/... \
  -H "Authorization: Bearer eyJ..." \
  -H "x-team-id: team_42"
```

## What to know

- **10 minutes.** `expires_in` is `600`. Cache the token and reuse it until
  shortly before it expires, then [refresh](/delegated-access/refresh-tokens/).
  Do not refresh before every call.
- **For one product.** A ZevCloud token is refused by every other product.
- **For one user.** It acts as the user who consented, and only within what
  that user can still do in the product.
- **Opaque to you.** It is a signed JWT, but treat it as a string. Its
  claims can change, and the product verifies it, not you.

## Name the target on every call

The token never carries targets. On each call, you say which target you are
acting on, in the product's own header, for example the ZevCloud team. The
product checks that this target is one the user picked, and that the user
still holds the role there that lets them connect apps.

Read the header name, and which calls need it, from the product's partner
guide. For ZevCloud it is `x-team-id`, on every call; see
[ZevCloud's connected apps guide](https://docs.zevcloud.net/guide/connected-apps). Other products are listed under
[Scopes by product](/delegated-access/scopes/).

> **Warning:**
> Never decode the token to find targets or permissions. Use `targets` and
> `scope` from the token response, which you stored. The token deliberately
> carries neither targets nor a promise that a permission still applies.

## When the product refuses a call

Products answer in their own words, but these meanings are shared:

| Response | What it means | What to do |
| --- | --- | --- |
| `401` | The token is expired, revoked, or older than the connection's latest change. | Refresh once and retry. If the refresh fails with `invalid_grant`, the connection is gone; see [Revocation](/delegated-access/revocation/). |
| `403` on a target | The user did not pick this target, or lost the role that allowed it. | Do not retry. Offer **Manage teams** (`prompt=configure`). |
| `403 high_risk_confirmation_required` | A high-risk permission's confirmation ended. | Send the user through `prompt=reconfirm`. See [High-risk permissions](/delegated-access/high-risk/). |
| `403 scope_paused` | The permission is paused. | Do not retry. See [Paused permissions](/delegated-access/paused-permissions/). |

A token minted before a change to the connection, such as a removed target
or a paused permission, is refused as stale even if it has not expired. A
refresh returns a token for the current version.