Home / Knowledge hub / Token
Knowledge hub
Token
A string that stands in for an identity or a permission.
What it means
A token is a string that stands in for an identity or a permission. Rather than send a password with every request, your software sends a token the receiving system recognises.
Session tokens, API keys and bearer tokens all work the same way. They carry proof that the system already authorised whoever holds them. RFC 6750 states the consequence plainly: any party holding a bearer token can use it.
Why it matters
Anything holding a token acts as whoever it represents. It needs no password, answers no second factor and explains itself to nobody. A leaked token is a working account until it expires or you revoke it.
So the useful questions concern storage and lifetime, not how long the string is. Where does this token live? How long does it work? How fast can you switch it off? Scope belongs on that list too. A token that can do one thing is a smaller problem than one that can do everything. Most integrations hold far more scope than they ever use.
How it shows up
Tokens leak in ordinary ways. A key in a URL lands in server logs and in the referrer header sent to third parties, which MITRE catalogues as CWE-598. A token in browser storage is readable by any script that reaches the page. A long lived API key sits in a config file somebody copied.
Short lifetimes, a revocation path, and storage that scripts cannot read remove most of the risk. Test revocation itself. Plenty of applications have a logout button that clears the browser and leaves the token working on the server. See also JWT and secrets management.
Questions people ask
Token, answered
Where should I store an access token in the browser?
The honest answer is that both popular options have a cost. Local storage is readable by any script on the page, so one cross-site scripting bug hands the token over. A cookie marked HttpOnly, Secure and SameSite keeps scripts out but needs cross-site request forgery protection.
Most teams land on the cookie, because script injection is the more common failure.
Is a JWT the same thing as a token?
A JWT is one format a token can take. It carries claims and a signature, so the receiving system can check it without a database lookup.
That convenience is also its awkward edge. Nothing about the format makes a JWT revocable, so you still need short lifetimes or a list of tokens you have withdrawn.
How long should a token last?
Short enough that a leaked one stops working before anybody notices it is gone. Access tokens measured in minutes, with a longer refresh token, is the common shape.
Never issue a token with no expiry. A token that lives forever turns one bad afternoon into a permanent problem.
Why is putting an API key in the URL a problem?
URLs get written down everywhere. Server access logs, proxy logs, browser history, analytics, and the Referer header your page sends to third-party scripts.
None of those places respect the token's intended lifetime. Send credentials in a header instead.
Can you revoke a token before it expires?
Only if you built a way to. Expiry limits how long a stolen token lasts, but it does nothing the moment you need the token dead now.
Test this before you need it. A logout that clears the browser and leaves the server happily accepting the same token is a common and unpleasant surprise.
Related
Terms that sit next to this one
JWT
A signed token a client carries to prove who is signed in.
Session hijacking
Stealing the token that tells your application a browser is logged in.
Secrets management
Keeping keys, passwords and tokens out of code and in a vault.
Authentication
Proving you are who you say you are. It answers one question only.
OAuth
The standard behind every sign in with and connect your account button.
Leaked token, working account?
Authentication, authorisation and exposed secrets are three of the ten classes Cyberlop tests, and every finding carries the request that proves it. Talk to us about your application.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.