token

A token is a signed string the server gives you after you log in, which you then send along on every later request to prove who you are — without typing your password again. Think of it as the wristband you get at a festival entrance: flash it, and you're waved through.

It's signed, so the server can tell at a glance whether it's genuine or tampered with. A common kind is the JWT (JSON Web Token), which actually carries a little readable payload inside — your user id, maybe your role, and an expiry time — wrapped in that tamper-proof signature.

You usually send it in an HTTP header like 'Authorization: Bearer <token>'. Because it stands in for your password, treat it like one: never paste it into a public chat or commit it to a repo, and let it expire so a stolen one doesn't work forever.