<!--
{
  "documentType" : "article",
  "framework" : "GSS",
  "identifier" : "/documentation/GSS/token-management",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Token Management"
}
-->

# Token Management

Establish secure communication with tokens.

## Discussion

The basic unit of currency in the GSS-API is the token. Applications using the GSS-API communicate with each other by using tokens, both for exchanging data and for making security arrangements. Tokens are declared as [`gss_buffer_t`](/documentation/GSS/gss_buffer_t) data types and are opaque to applications.

## Topics

### Buffer Flags

[`GSS_IOV_BUFFER_FLAG_ALLOCATE`](/documentation/GSS/GSS_IOV_BUFFER_FLAG_ALLOCATE)

GSS should perform the allocation.

[`GSS_IOV_BUFFER_FLAG_ALLOCATED`](/documentation/GSS/GSS_IOV_BUFFER_FLAG_ALLOCATED)

The caller should free the buffer.

[`GSS_IOV_BUFFER_TYPE_DATA`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_DATA)

The buffer type is packet data.

[`GSS_IOV_BUFFER_TYPE_EMPTY`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_EMPTY)

The buffer type is empty.

[`GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE)

GSS should perform the allocation.

[`GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATED`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATED)

The caller should free the buffer.

[`GSS_IOV_BUFFER_TYPE_FLAG_MASK`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_FLAG_MASK)

The buffer type is a flag mask.

[`GSS_IOV_BUFFER_TYPE_HEADER`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_HEADER)

The buffer type is a mechanism header.

[`GSS_IOV_BUFFER_TYPE_MECH_PARAMS`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_MECH_PARAMS)

The buffer contains mechanism-specific parameters.

[`GSS_IOV_BUFFER_TYPE_PADDING`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_PADDING)

The buffer contains padding.

[`GSS_IOV_BUFFER_TYPE_SIGN_ONLY`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_SIGN_ONLY)

The buffer contains sign-only packet data.

[`GSS_IOV_BUFFER_TYPE_STREAM`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_STREAM)

The buffer contains a complete wrap token.

[`GSS_IOV_BUFFER_TYPE_TRAILER`](/documentation/GSS/GSS_IOV_BUFFER_TYPE_TRAILER)

The buffer contains a mechanism trailer.

### Encapsulation and Decapsulation

Transfer tokens between peers by encapsulating and decapsulating them.

[`gss_encapsulate_token`](/documentation/GSS/gss_encapsulate_token(_:_:_:))

Returns a buffer encapsulating the given token.

[`gss_decapsulate_token`](/documentation/GSS/gss_decapsulate_token(_:_:_:))

Returns a token encapsulated in a buffer.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)