Tokens

Definition

A digital key or string of characters representing authentication, authorization, or information that can be passed securely between client and server to verify identity or access rights.

What Problem It Solves

Tokens solve the security risk of repeatedly transmitting username and password credentials. They represent a signed, time-limited proof of identity (like a JWT) that can be sent securely with every stateless API request without exposing raw credentials.

What Happens If Not Used

Without tokens, client applications would have to store and transmit raw passwords with every database call, exposing credentials to theft via browser storage exploits and raising the risk of permanent account compromises.

Easy Wording

A digital security pass or ticket that proves you are allowed access, without having to enter your username and password every time.

Layman Example

A wristband at an amusement park. You show your ID and pay at the gate once, and they give you a wristband (token). For the rest of the day, you just show the wristband to get on the rides without re-paying or re-proving who you are.

Technical Example

After a user logs in, the server generates a JSON Web Token (JWT) signed with a private secret key:

// JWT Payload structure
{
  "sub": "1234567890",
  "name": "Kamran Mushtaq",
  "role": "admin",
  "exp": 1718428800
}

The client stores this token (e.g., in localStorage or cookies) and sends it in the HTTP Headers:

Authorization: Bearer <token_string_here>