A detection signal with no legitimate reason to fire
A honeytoken is a fake credential, key, or record deliberately placed somewhere an intruder exploring a compromised system might plausibly find it, with no legitimate function of its own — nothing in normal, authorized operation should ever have a reason to use it. That absence of any legitimate use case is what makes the signal so reliable: most detection mechanisms have to filter out substantial legitimate activity to find the suspicious cases, while a honeytoken being touched at all is itself already the suspicious case.
This makes honeytokens a useful complement to detection methods that rely on distinguishing normal from abnormal patterns — a task that's inherently probabilistic and prone to both false positives and false negatives. A honeytoken sidesteps that difficulty specifically because there's no 'normal' use of it to distinguish from at all.
The value depends on realism and response
A honeytoken only works if it's genuinely indistinguishable from a real credential to whoever finds it — an obviously fake one placed too conveniently teaches a careful attacker to avoid it rather than trigger it. And the alert it generates only matters if it reaches someone able to respond quickly; a honeytoken that fires an event into a log nobody actively monitors provides the opportunity for detection without any of the actual benefit.