Token bloat
Token bloat is what happens when an identity or access token, often a JWT, carries an excessive amount of roles, groups, permissions, scopes, attributes, entitlements and other claims.
- Synonym
- bloated tokenoversized JWT
Definition
Token bloat is not only a size problem. As more authorization data is pushed into the token, the token gradually becomes an embedded copy of the entitlement model. Information that would sometimes be better evaluated at the moment of the action ends up frozen in a token issued earlier, with freshness, revocation and exposure consequences. Keycloak illustrates the mechanism well: realm roles, client roles, composite roles and custom claims can all be mapped into tokens, so a role explosion can turn into token bloat once a large share of those roles is emitted to clients. The two are not synonyms: you can hold thousands of roles without sending them to the token, and you can produce an enormous token with only a handful of roles because of groups, attributes or other claims.
Why it matters
A token that carries the entitlement model spreads authorization data across proxies, logs and browsers, and freezes decisions that should have been recomputed at the moment of the action.
The Ariovis perspective
A token should carry what the exchange needs, not become the enterprise entitlement database. Stable information required for authentication or delegation belongs in the token; when the decision depends heavily on the resource, the action, the relationship, data sensitivity, context or risk, evaluate authorization at the moment of the action through a PDP/PEP architecture instead of adding one more claim.
Related services
Common pitfalls
- Assuming token bloat always comes from too many roles: groups, attributes and business claims produce it just as easily.
Standards and protocols
- RFC 7519
- RFC 9068
- OAuth 2.0
- OpenID Connect
- JWT
Resources
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.