Zscaler

Global – October 12, 2026 -- Re-validating an access token at every request would multiply the load on an identity provider (IdP) by roughly 1,000x, assuming a 24-hour token is used 1,000 times. That figure is why the OpenID Foundation's Shared Signals Framework (SSF) is gaining traction as the mechanism for keeping Zero Trust access decisions current.

Short-lived tokens cut IdP load to about 24x but degrade user experience

Shortening a token's life from 24 hours to one hour raises IdP burden by only about 24x. Users, however, face repeated redirects to the IdP and back, which degrades the experience. Neither approach lets an organization instantly revoke access after a termination or rogue agent activity, or react when device or task conditions change while a token is still valid.