---
url: https://docs.youcan.shop/changelog/embedded-app-token-types.md
---

You can exchange a session token for an online or an offline store token.

***

# Online and offline tokens for embedded apps

* You can ask for an online token with `requested_token_type=urn:youcan:params:oauth:token-type:online-access-token`.
* An online token is tied to the person who opened your app.
* An online token is valid for 24 hours, with no refresh token.
* An online token's scopes are cut down to that person's store permissions.
* You get `associated_user` and `associated_user_scope` in the response of an online exchange.
* You get the same offline token on every exchange for one store. Its scopes are updated to your app's current scopes.
* The standard token exchange parameters are accepted: `grant_type=urn:ietf:params:oauth:grant-type:token-exchange`, `subject_token` and `subject_token_type=urn:ietf:params:oauth:token-type:id_token`.
* `grant_type=token_exchange` with `session_token` is still accepted.
* Session tokens are valid for 1 minute instead of 5.
* See [Token types](/apps/embedded_app/auth#token-types).