Glossary
Session Token
A session token stands in for a principal's primary credentials after it has authenticated once, so a password or key does not need to be resent with every request. Its usefulness depends entirely on its lifetime and handling: a token that lives for a long time, or that can be replayed from a copy without detection, becomes nearly as sensitive as the credential it stands in for.
Shorter-lived tokens, refreshed frequently through a separate, more tightly controlled mechanism, bound the damage from a leaked token to a narrow window rather than an open-ended one.