Authentication Token
What is Authentication Token?
An authentication token is a secret string a client presents to prove its identity before a system grants access: a long-lived API key identifies a tenant or service account, a short-lived one-time code confirms possession of a device, and a signed bearer token carries expiry and scope so a leaked credential dies quickly. The server never trusts the caller's word; it validates the token on every request.
More detail
Token designs trade convenience against blast radius. A static API key is simple to store and rotate per environment but lives until revoked, so production keys get scoped to the minimum set of actions and kept in a secret manager rather than source control. A short-lived token — a one-time passcode valid for minutes, or a signed bearer token with an expiry claim — shrinks the window in which a captured credential is useful, which is why sign-in flows and payment step-ups prefer one-time codes over reusable passwords.
Verification is only as strong as the channel carrying the token: an SMS one-time code can be intercepted by a SIM swap, which is why high-assurance flows layer a device-bound factor such as a passkey or TOTP on top. Machine-to-machine traffic uses a different shape of the same idea — an HMAC signature or bearer credential attached to each request lets the receiver prove the sender held the secret without the secret itself crossing the network.
On Devotel Orbit, authentication tokens appear in three shipped surfaces: the tenant API key your SDK sends on every API call, the per-endpoint webhook signing secret your receiver uses to verify each delivery's HMAC-SHA256 signature, and the one-time codes the Verify suite delivers over SMS, voice, WhatsApp, email, or RCS when a user signs in or approves a sensitive action.
Frequently asked
- What is the difference between an authentication token and a password?
- A password is a long-lived secret a human remembers and reuses across sessions; an authentication token is issued to a client or generated per session with a limited scope and lifetime. Tokens can be revoked or expired individually without forcing anyone to change a memorized secret, and machine clients such as SDKs and servers hold tokens rather than passwords.
- How long should an authentication token live?
- As short as the flow allows. One-time codes are good for minutes, signed bearer tokens for minutes to hours, and static API keys only as long as a rotation policy permits — the shorter the lifetime, the smaller the window in which a captured token is useful. Long-lived credentials should be scoped narrowly and rotated on a schedule.
- Where should an authentication token never be stored?
- In source control, client-side JavaScript, or logs. Secrets belong in a secret manager or server-side environment configuration; anything committed to a repository or shipped to a browser should be treated as already leaked, revoked, and reissued.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.