> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enabling Single Access Token

> Technical information on enabling a single access token per subject in Authlete to ensure that only the newest access token is valid for each user.

<Note>
  This page is for **Authlete 2.x**. For current (3.0) documentation, see [this page](/configuration-reference/tokens-and-claims/enabling-single-access-token-per-subject).
</Note>

<img src="https://mintcdn.com/authlete/VMCNat22v2IOj3-M/img/kb/en/oauth-and-openid-connect/access-tokens/single-access-token-per-subject.png?fit=max&auto=format&n=VMCNat22v2IOj3-M&q=85&s=d1053653579c93bdd5300cc6b2b063a7" alt="single-access-token-per-subject" width="960" height="541" data-path="img/kb/en/oauth-and-openid-connect/access-tokens/single-access-token-per-subject.png" />

Authlete issues a new access token for each time when the same user grants authorization request from a client (i.e. authorization server calls Authlete's [POST /auth/authorization/issue](/api-reference/authorization-endpoint/issue-authorization-response) API with the same "subject" value).

By default, Authlete doesn't invalidate access tokens that are related to the user and have been issued before. Thus the client eventually has multiple valid access tokens at the same time.

In some environment, authorization server is required not to issue multiple valid access tokens in such a way. For Authlete to achieve this, it provides "Single Access Token Per Subject" option in Service Owner Console.\\

<img src="https://mintcdn.com/authlete/VMCNat22v2IOj3-M/img/kb/en/oauth-and-openid-connect/access-tokens/single-access-token-per-subject_1.png?fit=max&auto=format&n=VMCNat22v2IOj3-M&q=85&s=3760cf5eb06c3695acbb15a4b1c50da8" alt="single-access-token-per-subject_1" width="556" height="432" data-path="img/kb/en/oauth-and-openid-connect/access-tokens/single-access-token-per-subject_1.png" />

*Single Access Token Per Subject*

Once enabled, Authlete invalidates previous access tokens and refresh tokens associated with them in conjunction with issuing a new access token. It ensures the newest access token is the only valid one.