Tokens: the key that tells the server who you are

Think of the ID card your boss gives you when you walk into the office. Without it, nobody lets you in. With it, the guard knows exactly who you are and which doors open for you.

On the network, the token is that pass. The server generates it when you log in — when you enter your name and password — and stores it in your browser or app. Every time you make a request, you send the token along with it. The server reads it, checks that it's valid, and lets you in.

It's not the password. It's a long, random number that changes every time you log in. If someone steals it, they can use it as if they were you — which is why it's stored on the phone, not on a piece of paper. If the server revokes your token, that pass is no good; it's like when they take the office key away.

Modern tokens have an expiry date. After that time, they expire and you have to log in again. This protects against theft: even if someone steals it, after a while it stops working.

There are two main types: access tokens, which last minutes, and refresh tokens, which last days. The access token is the pass you use on every request. The refresh token is the one you ask the server for to swap the old pass for a new one without re-entering your password.

The analogy: it's the parking pass. You put it on the dashboard. The guard reads it and knows how much time you have left. When it expires, you swap it. If someone steals it, they can use the car — but only until it expires.

Check whether the app you use lets you revoke session tokens from settings. If you see a list of connected devices, revoke the ones you don't recognize — that closes the door to anyone holding an old pass.

Why this matters for us: