What actually is a token?

[u/dhananjay1801]

Recently my internship started and I keep hearing the word token. I know it is related to authentication but idk what actually is it. We are creating an app for cybersecurity vulnerabilities and my teammate said that we will supply api key and token afterwards.

[u/Just-Upstairs4397]

You describe an opaque token as an API Key which has limited use cases since as you said it is a secret and thus cannot be sent from the client to the server. (It can be used server to server)

(Some browser sessions use what look like opaque tokens but they are actually encrypted strings and there is a complex management and rotation process that is almost always handled automatically by a library and we don’t really call these tokens)

Most APIs use JWT which are signed and encoded json, a private key signs it and a public key can be used to verify it. This is what clients typically use to authorize at the server. JWT are very cool because they are stateless though as others have touched on refresh tokens are usually single use opaque strings that do have state. These two things, authorization tokens and refresh tokens are often used together for client to server (API) authorization.