Auth Token
An auth token is a string that a program presents as proof that it has previously logged in successfully. Instead of sending a password or key again with every request, this time-limited piece of text is included instead.
When you log in to a service on the internet, the server checks once whether your password is correct. Afterward, it sends you back a long, randomly-looking string. This string is the auth token. With every further request, you attach it, and the server uses it to know who you are. A comparison helps: at the entrance of a festival, you show your ID once and get a wristband. After that, the wristband is enough, and your ID stays in your pocket.
Why passwords shouldn’t constantly travel across the network
A password is permanently valid and often the same across several services. Whoever intercepts it has unlimited access to your account. An auth token, on the other hand, expires after a short time, sometimes after just one hour. Even if someone steals it, the damage is limited in time. Additionally, the operator can invalidate a single token without you having to change your password.
A token can also carry limited permissions. If a photo app wants to access your cloud storage, it receives a token only for images. Your emails remain invisible to it. This fine-grained distinction would be impossible with a password, since a password always opens everything.
For companies, this is also a question of cost. In the world of AI services, every company pays per request to a model. Whoever gets hold of someone else’s token can have requests billed to the owner’s account. Accidentally published tokens on platforms like GitHub are therefore a regularly reported security incident.
What’s inside such a string
There are two basic forms. The first is a purely random value with no meaning. The server keeps a list and looks up, with every request, who the value belongs to. This is simple, but it generates a database query on every call.
The second form is called JSON Web Token, or JWT for short. Here the information sits directly in the token: user ID, expiration time, permitted actions. So that no one can alter this data, a cryptographic signature is attached. This is a check value that only the server can generate with its secret key. If someone changes even a single character, the signature no longer matches and the token is rejected.
An important common misconception: a signed token is not encrypted. The content can be read by anyone who intercepts it. The signature only protects against forgery, not against snooping. That’s why passwords or personal data should never go inside a token.
From phone login to AI interface
You use auth tokens daily without seeing them. Every app in which you log in only once and then stay logged in for weeks stores such a token in the background. The “Sign in with Google” button also works this way: Google verifies you and issues the other site a token.
In programming, the term appears especially often with interfaces, meaning the access points through which programs talk to each other. Anyone who integrates an AI model from OpenAI or Anthropic into their own software receives a key or token for it. It is sent along with every request and determines access and billing.
Watch out for a mix-up: in texts about language models, “token” means something completely different, namely a piece of a word that a model processes. Only the addition “auth” makes clear that it refers to the proof of access. In news articles, the term usually comes up when tokens have been made public through an error.
