SSO tokens are digital keys that identify a user to an online service. They are used in multi-factor authentication systems, which can be seen as a form of access control. Tokens are digitally signed, and the application and service provider share them to ensure that the information comes from a trusted source.