# OAuth token

Canonical page: /glossary/oauth-token

API keys & secrets glossary, Keys & secrets. OAuth Token: How It's Different From an API Key

**Short answer:** An OAuth token is a credential a service issues after you complete a login and consent flow, rather than one you generate and copy manually like an API key. OAuth tokens are usually short-lived and paired with a longer-lived refresh token that fetches new ones automatically.

## Why it matters

This design limits how long a leaked token stays useful, since it expires on its own, but it does mean an application needs extra logic to handle refreshing it, which is more involved than reading a static API key.

## In Claude Keychain

Claude Keychain is built for static secrets like API keys and PATs. An OAuth token that refreshes automatically is usually better handled by the application's own login flow rather than pasted into a secrets manager.

## Common questions

**Can I store an OAuth token in Claude Keychain?**

Yes, if it is not going to expire during your session, but a token that refreshes every hour is a poor fit for manual storage.

**Why do some services only offer OAuth, not API keys?**

OAuth gives the service finer control over what a specific login session can access, and lets a user revoke access without changing a password.

## Related

[API key](/glossary/api-key), [Personal access token (PAT)](/glossary/personal-access-token), [JWT (JSON Web Token)](/glossary/jwt)