The federal government is requiring access and identity tokens to remain valid for no longer than one hour, according to final guidance issued September 15 by the Cybersecurity and Infrastructure Security Agency and the National Institute of Standards and Technology. Interagency Report 8587 addresses the security of tokens that power single sign-on, identity federation and API access, which the agencies say adversaries increasingly exploit to move through networks and access sensitive information. The guidance targets federal agencies, cloud service providers and organizations that purchase from them, though compliance remains voluntary.
The report sets out a series of technical controls for token and key management. Authorization services and policy enforcement points must reject expired tokens outright. For key management, signing keys in high-impact systems should be rotated at least once every 90 days, while rotation must occur within a year for all other systems. At moderate impact levels and above, keys must reside in hardware-backed or isolated storage and can't be stored persistently on servers, virtual machines or containers that use them. High-impact systems must also perform signing within an isolated execution environment. Every token must include an explicit audience field, and access control mechanisms must reject any token lacking one. Keys must be scoped to the narrowest reasonable boundary, and a key valid outside a federally authorized environment can't sign tokens inside one. The guidance also prohibits writing tokens themselves, or any personal data they contain, to logs. The report notes that AI agents increasingly rely on signed tokens to access systems, data and APIs, and states the guidance applies to them as well, though broader AI agent access risks fall outside its scope.
The guidance emerged from two major token compromise incidents, according to the agencies. In a 2020 supply chain breach, attackers who had compromised Active Directory Federation Services created forged SAML assertions to bypass multifactor authentication at thousands of organizations, including federal agencies. In the second incident, foreign actors obtained a consumer signing key that had been exposed accidentally, then used it to forge tokens. Token validation failures allowed the key to generate valid signatures inside enterprise and government systems, resulting in the theft of more than 60,000 emails from one agency. "Identity is the new perimeter, and the tokens and assertions behind it are attractive targets for sophisticated adversaries," said Chris Butera, CISA's acting executive assistant director for cybersecurity. He said the guidelines offer a path to harden token issuance so a stolen credential can't become a foothold across the federal enterprise.
The report's recommendations reflect a fundamental shift in how cloud environments are compromised. Rather than breaking through traditional network defenses, attackers now steal or forge the digital credentials that grant access across cloud platforms, allowing them to impersonate legitimate users and bypass multifactor authentication entirely. The one-hour token lifespan aims to narrow the window during which a stolen token remains useful, while frequent key rotation and hardware-backed storage make it harder for adversaries to forge tokens from scratch. The agencies emphasize that even AI systems using tokens to interact with data and APIs create new attack surfaces that require the same protections. CISA said nearly 250 public comments shaped the final text, with input from Google, Microsoft, Okta, Amazon Web Services, Oracle, IBM, HashiCorp, Wiz and the OpenID Foundation through its Joint Cyber Defense Collaborative. The voluntary nature of the guidance means its effectiveness will depend entirely on how many organizations choose to adopt controls that add complexity to their authentication systems. Federal agencies may face pressure to implement the standards even without a mandate, while private sector adoption will likely hinge on whether the operational costs of hourly token expiration and quarterly key rotation prove manageable at scale.