# I would like to restrict a token to one device **URL:** \ **Category:** Get Help\ **Tags:** security, token-url, bearer-token, token, serverside\ **Created:** [December 3, 2017, 11:04pm UTC](https://community.auth0.com/t/i-would-like-to-restrict-a-token-to-one-device/8874 "2017-12-03T23:04:35Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ngodasamuel](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@ngodasamuel](https://community.auth0.com/u/ngodasamuel)\ **Post date:** [December 3, 2017, 11:04pm UTC](https://community.auth0.com/t/i-would-like-to-restrict-a-token-to-one-device/8874/1 "2017-12-03T23:04:35Z")
is it possible to restrict a token to one device so that someone cannot copy the token and use it on another device? ---
**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\ **Post date:** [December 4, 2017, 6:41pm UTC](https://community.auth0.com/t/i-would-like-to-restrict-a-token-to-one-device/8874/2 "2017-12-04T18:41:12Z")
At this time, the issued access tokens are considered bearer tokens which means that any entity that has access to the token (the bearer) can perform requests using that access token for as long as the access token remains valid. There is an OAuth draft about token binding that would address your requirements, but at this time it is not supported or even widely used. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 2, 2018, 5:57am UTC](https://community.auth0.com/t/i-would-like-to-restrict-a-token-to-one-device/8874/3 "2018-03-02T05:57:37Z")