IT Glossary
What is a token?
The digital pass: a secret string proving permission — for sessions, interfaces and payments — issued at login, time-limited and revocable.
A token is a pass, and whoever holds it gets in. Once you have proved your identity, you do not retype the password at every step; you receive a secret string functioning as a badge that says the bearer of this is allowed to do the following. It is one of the most many-faced concepts in computing, but four threads matter to a company. Session tokens are the reason you stay logged in, presented by the browser on every request instead of the password, and the reason modern information stealers prioritise session cookies: a stolen badge enters the account without the password and frequently past two-factor authentication, which is why logging out on borrowed devices and using the sign-out-everywhere button at any suspicion both matter. Interface keys are how systems authenticate to each other in integrations — your application to the payment processor, to the e-invoicing system, to the courier — and they are company secrets to be treated like passwords: held in a secrets vault rather than in code or email, granted the minimum rights each one needs, rotated periodically, revoked instantly on doubt. Then come authentication tokens in hardware and software form, from code generators to the physical key carrying a qualified certificate. And finally payment tokenisation, the reason serious merchants never store card numbers. The common thread, and the administration lesson, is that a token is power detached from identity.
Let’s talk about your project
Message us on WhatsApp or send an email — you talk directly to a developer.
office@northdan.com · +40 752 070 247
Why it matters for your business
Access without passwords in transit
Sessions and integrations run on temporary passes, so the password stays rarely used and well guarded instead of being presented at every single step.
Powers cut to size
A token with minimum rights — read only, one service only — structurally limits the damage of any leak: a small key opens only a small door.
Surgical revocation during an incident
A compromised pass is cancelled individually and instantly, with no full account reset and without stopping the other integrations that depend on separate keys.
Frequently asked questions
What does it mean that my sessions were stolen, and what do I do?
It means the attacker holds active passes, typically session cookies harvested by an information stealer from an infected device, and enters accounts without the password, often bypassing two-factor authentication as well. The correct order of response: sign out all devices and sessions from the account security settings, which invalidates the stolen passes; change the password from a clean device; review account rules and authorised applications; and clean the source device, otherwise the harvest resumes tomorrow.
How should our integration keys be stored?
Like money, in a safe: dedicated secrets management, from the vaults built into cloud platforms to specialised tools — never in code, in configuration files committed to repositories, in email or in shared documents. Each key gets minimum rights, since a stock-reading integration does not need invoicing permissions, plus periodic rotation and an inventory of which keys exist, who owns each and what access it grants. Ask your development supplier where the project secrets live; an answer of in the code is a defect to report.
What is payment tokenisation and why does it protect customers?
It replaces the real card number with a substitute valid only for that merchant and context, so the card saved in your shop is actually a token held by the processor and the real number never touches your systems. The consequences are large: a breach at the merchant no longer spills usable cards, the compliance burden drops dramatically, and recurring or one-click payments become possible without storage risk. It is the standard architecture of modern payments and the reason proper processor integration beats any homemade card-saving scheme.
Let’s talk about your project
Message us on WhatsApp or send an email — you talk directly to a developer.
office@northdan.com · +40 752 070 247