DAT is an access token that multiple services issue and verify under the same specification. A token contains an expiration time, certificate ID, public data, encrypted data, and a signature. A verifying server checks the token with its own certificate instead of asking the issuing server every time.

A certificate combines the token's signature and encryption methods, keys, issuance period, and TTL. With DAT CMS, services can synchronize full or verify-only certificates instead of distributing certificates themselves.

The issuing service creates DATs with full certificates, while the verifying service checks them with verify-only certificates. DAT CMS is optional; environments that distribute certificates directly can use only the client's local manager.