What is an API Token?

Tokens differ from simple API keys in a few important ways: they're often short-lived (expiring after minutes or hours), scoped to specific permissions rather than blanket account access, and in the case of JWTs, self-contained — the token itself carries claims like user ID, tenant, and granted scopes that a server can verify without a database lookup, using a cryptographic signature. Because tokens expire, systems built around them need a refresh flow: when the access token nears expiry, the client uses a longer-lived refresh token to get a new one, without forcing the user to log in again. This balances security (a stolen access token has a short useful life) against usability (the user isn't constantly re-authenticating). Token handling is a common source of real security bugs: trusting an unverified claim inside a token, failing to check expiry, or accepting a token whose signature wasn't actually validated against the expected signing key are all classic mistakes that effectively defeat the whole point of using tokens in the first place.