Single sign-on systems work by authenticating users from a centralized location or using a centralized method, and then allowing applications that trust the system to grant those users access. What wo

While some older SSO systems like Kerberos use "tickets," "token" is a more general and widely applicable term for the object passed in modern web-based SSO contexts.

Certificates are primarily used for verifying the identity of servers or encrypting communication, not typically as the direct object passed between an SSO system and an application for user authorization.

Credentials (like username/password) are what the user provides to the authentication system initially, not what the authentication system passes to applications to grant access.

In modern SSO systems, especially web-based ones using protocols like OAuth 2.0 or OpenID Connect, an authentication server issues a security token (e.g., an ID token or access token) to the client application after successful user authentication. This token, which cryptographically asserts the user's identity and/or permissions, is then presented to other trusted applications to gain access.