# TokenProvider token caching

Finally, we will cover token caching in a TokenProvider implementation. The SCTProvider is essentially useless without a cache, as otherwise there is no way for a third-party to know the secret key corresponding to a SecurityContextToken. Any TokenProvider implementation can cache a generated token in the [TokenStore](http://cxf.apache.org/javadoc/latest-2.6.x/org/apache/cxf/ws/security/tokenstore/TokenStore.html) object supplied as part of the TokenProviderParameters.

The SCTProvider creates a SecurityToken with the ID of the SCT, the secret key associated with the SCT and the client principal. If a "realm" is passed through, then this is recorded as a property of the SecurityToken (keyed via [STSConstants](http://svn.apache.org/viewvc/cxf/trunk/services/sts/sts-core/src/main/java/org/apache/cxf/sts/STSConstants.java?view=markup).TOKEN\_REALM). Finally, the STS ships with two TokenStore implementations, an in-memory implementation based on eh-cache, and an [implementation](http://svn.apache.org/viewvc/cxf/trunk/services/sts/sts-core/src/main/java/org/apache/cxf/sts/cache/HazelCastTokenStore.java?view=markup) that uses Hazelcast.