Glossary
API Token
An API token is a secret string issued by a server that a client includes in requests to prove its identity and authorise access to protected resources, without transmitting a username and password on every call.
General definition
An API token is the most common mechanism for authenticating programmatic access to a web API. When a developer or application registers with a service, the service issues a token. The client stores the token securely and includes it in subsequent HTTP requests, typically in the Authorization header as a Bearer token or in a custom header such as X-API-Key.
- App token / API key: a long-lived credential tied to an application, used for server-to-server calls
- User token / session token: a short-lived credential tied to an authenticated user session
- JWT (JSON Web Token): a self-describing signed token that carries claims (user ID, roles, expiry) so the server can verify it without a database lookup
- OAuth 2.0 access token: a short-lived token issued by an authorisation server after a user grants consent, used for delegated access
Tokens are preferable to passwords for API access because they can be scoped (a token may only allow reads, not writes), rotated without changing the password, revoked independently, and audited individually. A compromised token can be invalidated without affecting other tokens or the underlying account.
Secure token practices include storing tokens in environment variables rather than source code, setting short expiry windows for user-facing tokens, using HTTPS to prevent interception, and rotating tokens on a schedule. See also JWT for the self-describing token format and SSO for token-based federated identity.
In the Ethora ecosystem
Ethora issues two types of tokens for developers: an app token that authenticates server-side API calls (creating users, sending messages, managing channels) and a user token (JWT) that the mobile or web client uses to connect to the real-time XMPP layer. The app token is created in the Ethora dashboard and should be stored in your backend environment variables, never in client-side code.
The Chat SDK and AI SDK accept the user token at initialisation time. On self-hosted deployments, token signing keys stay within the customer’s own infrastructure, which is a key requirement in regulated industries where credential material must never leave a controlled environment. Token rotation and revocation are supported via the management API.
