Proof of user authentication. It’s used by the Security Server. When the Security Server authenticates a user, it creates a credential as part of the authorization session.