When should I use a password vs a token vs an API key?
Passwords for human login. Tokens (JWT) for session continuity after login. API keys for programmatic access from services, scripts, or third parties. Use all three based on the use case.
Explore This Question
Search for additional explanations using these tools:
More FAQs in Password vs Token vs API Key: When to Use Which
In an httpOnly, secure, sameSite cookie for web apps. In secure storage (Keychain, Keystore) for mobile apps. Do not use LocalStorage (open to XSS).
Hashed, like passwords. Send the raw key once on creation; the user stores it. Compare hashes on each request. If the database is leaked, attackers cannot use the hashes.
Short: 15 minutes for the access token. Use a refresh token (longer, e.g., 7 days) to get new access tokens. Short expiry limits the damage if a token is stolen.
Still have questions?
Browse all our FAQs or reach out to our support team