An access token is a value used by a system to represent permission or an authenticated context for certain requests. Its scope and lifetime depend on the implementation. Tokens can appear in headers, URLs or stored application data, and disclosure may allow another party to make requests without knowing the original account password directly.
A practical example
A playlist address can include a long parameter that authorizes retrieval for an account. Sharing that complete address can reveal usable access information even when the username and password do not appear as obvious separate words in the visible URL.
A common misunderstanding
Do not treat an unfamiliar string as harmless merely because it is not labelled password. Redact private tokens from screenshots, sample links and logs before posting them outside the intended support channel.
Related terms
Stable technical definition. Editorial approach