This, along with other interview questions on OpenStack, is a regular feature in OpenStack interviews, be ready to tackle it with an approach mentioned below. In OpenStack, tokens are used for authenticating and authorizing the user’s interaction with OpenStack APIs. tokens are of different types specifying various levels and scopes of authorization. The general purpose of the token is to relay information about your role. A user can have multiple role assignments, projects, domains, and others, known as authorization scopes, where the token has a single scope of operation.   Different scopes of tokens are-  Unscoped tokens- they do not have a service catalogue, roles, or authorization scope. They just prove the user’s identity to keystone. There is no need to specify an authorization scope in your authentication request.  Project-scoped tokens- such tokens authorize the user to operate in a specific cloud tenancy and are helpful for things like spinning up compute resources or carving off block storage. To consume resources in deployment, users must have role assignments on projects.  Domain-scoped tokens- such tokens authorize the user to operate on the contents of a domain or the domain itself. If the user has access to the domain, they can manage things within the domain, such as creating new users and projects.  System-scoped tokens- some APIs affect the entire deployment system, such as modifying endpoints and service management. Such tasks are reserved for operators and require system-scoped tokens, representing the role assignments a user has to operate on the deployment, such as system admins and cloud admins.