When should I use a password vs a token vs an API key?
Passwords for human login. Tokens (JWT) for session continuity after login. API keys for programmatic access from services, scripts, or third parties. Use all three based on the use case.
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in Password vs Token vs API Key: When to Use Which
In an httpOnly, secure, sameSite cookie for web apps. In secure storage (Keychain, Keystore) for mobile apps. Do not use LocalStorage (open to XSS).
Hashed, like passwords. Send the raw key once on creation; the user stores it. Compare hashes on each request. If the database is leaked, attackers cannot use the hashes.
Short: 15 minutes for the access token. Use a refresh token (longer, e.g., 7 days) to get new access tokens. Short expiry limits the damage if a token is stolen.
Still have questions?
Browse all our FAQs or reach out to our support team