An identity token based access control system and method is disclosed. A distributed security system that manages access to business and/or governmental entities creates an identity credential for a user and obtains or generates a globally unique identity token for the user, and loads the identity credential and the identity token onto a user device. The user then presents the user device including the identity credential and the identity token to an access control system (ACS) of the security system of the business entity that generated the identity token to obtain access to its security system, or to an ACS of a security system of one or more third party business entities that support the use of identity tokens to obtain access to the security systems of the third party business entities. The identity tokens are preferably random numbers or strings. The identity credentials typically include biometric information for users.