A server performs authentication, in response to an authentication request from a client PC and issues a token, when the user of an application is permitted. When the client PC needs to use the application in an offline state, the client PC requests the server to change over to a standalone mode. The server then changes the issued token to an offline token that is valid for a predetermined time period. The offline token includes dynamic date and time information that is updated on every occasion of authentication, as well as static information indicating a validity period. Including the dynamic date and time information prevents illegal use of the token by causing the client PC's timepiece to go back in time after expiration of the validity period. This configuration enables an online authentication system to be used offline, while preventing illegal use, taking advantages of both online and offline authentications.