What is Token?

A temporary pass that proves who you are. Access tokens expire quickly; a refresh token quietly gets a new one.

Where Token goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Pro
Logged out after an hour
Users fill in a long form, press Save, and get 'Unauthorized'. It always happens about an hour after they signed in.
Why do my users get logged out after an hour?
Access tokens are short-lived, often about an hour, and must be renewed with a refresh token. If nothing refreshes the session before requests, especially on server-rendered pages that cannot set cookies, users see 'Unauthorized'. Refresh the session in code that runs before each request.
Read the fix
Teams and sharing · 4 minutes · Free
Removed, but still inside
You removed a contractor from your team at 2:00pm. At 2:40pm they downloaded the customer list.
Why can a removed user still access data?
If your security rules read the user's role from their sign-in token (JWT claims), the old role stays valid until that token expires, an hour by default in Supabase. Signing them out doesn't revoke a token already issued. Check team membership in the database inside your RLS policies, so every request sees the current team list.
Walk it, free
Accounts and privacy · 4 minutes · Pro
The immortal reset link
A customer forwarded an old 'reset your password' email to a colleague by mistake. Months later, that link still lets anyone set a new password.
How long should a password reset link last?
A reset link should expire after a short time, often 15 to 60 minutes, work only once, and be cancelled when a newer link is requested. After the password changes, sign out other sessions and email the owner. Tokens must be long and random. A link that never expires turns every old email into a working key.
Read the fix
Teams and sharing · 3 minutes · Pro
The share link next door
Your app lets people share a read-only report with a link. A user changed one digit in theirs and opened a stranger's financial report.
How do I make share links secure?
A share link works like a password in a URL, so it must be impossible to guess. Never use sequential numbers or short codes; generate a long random token for each shared item. Let owners revoke links and set expiry, because even unguessable links leak through forwarding, browser history and chat previews.
Read the fix
Bills that explode · 5 minutes · Pro
The address box that cost $1,900
Your checkout suggests addresses as people type, using a maps API. Orders are steady, but this month's maps bill is $1,900.
How do I reduce my Google Maps API bill?
Count what triggers each call. Address autocomplete often sends a billable request on every keystroke. Wait for a short pause and a few characters, use session tokens so searches can be billed together when a place is chosen, restrict your key to your site and the APIs you use, set daily quotas, and cache only what the provider's terms allow.
Read the fix
Keeping it running · 4 minutes · Pro
The password in the logs
To debug a sign-in bug, your AI added a log line. Weeks later you open your hosting logs and see customers' passwords in plain text.
Is it dangerous to console.log request bodies?
Yes. Logging a whole request body copies everything the user sent, including passwords and tokens, into your hosting logs, where teammates, log services and anyone with a stolen login can read it. Log what happened, such as a user id and outcome, never request bodies. If secrets reached the logs, delete them and protect affected users.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Authentication: Checking who someone is, usually by signing in.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
Session: The app's memory that you are signed in, kept for a while so you don't log in on every page.

All 62 terms in the glossary

Where Token goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Pro

Logged out after an hour

Users fill in a long form, press Save, and get 'Unauthorized'. It always happens about an hour after they signed in.

Why do my users get logged out after an hour?

Access tokens are short-lived, often about an hour, and must be renewed with a refresh token. If nothing refreshes the session before requests, especially on server-rendered pages that cannot set cookies, users see 'Unauthorized'. Refresh the session in code that runs before each request.

Read the fix

Teams and sharing · 4 minutes · Free

Removed, but still inside

You removed a contractor from your team at 2:00pm. At 2:40pm they downloaded the customer list.

Why can a removed user still access data?

If your security rules read the user's role from their sign-in token (JWT claims), the old role stays valid until that token expires, an hour by default in Supabase. Signing them out doesn't revoke a token already issued. Check team membership in the database inside your RLS policies, so every request sees the current team list.

Walk it, free

Accounts and privacy · 4 minutes · Pro

The immortal reset link

A customer forwarded an old 'reset your password' email to a colleague by mistake. Months later, that link still lets anyone set a new password.

How long should a password reset link last?

A reset link should expire after a short time, often 15 to 60 minutes, work only once, and be cancelled when a newer link is requested. After the password changes, sign out other sessions and email the owner. Tokens must be long and random. A link that never expires turns every old email into a working key.

Read the fix

Teams and sharing · 3 minutes · Pro

The share link next door

Your app lets people share a read-only report with a link. A user changed one digit in theirs and opened a stranger's financial report.

How do I make share links secure?

A share link works like a password in a URL, so it must be impossible to guess. Never use sequential numbers or short codes; generate a long random token for each shared item. Let owners revoke links and set expiry, because even unguessable links leak through forwarding, browser history and chat previews.

Read the fix

Bills that explode · 5 minutes · Pro

The address box that cost $1,900

Your checkout suggests addresses as people type, using a maps API. Orders are steady, but this month's maps bill is $1,900.

How do I reduce my Google Maps API bill?

Count what triggers each call. Address autocomplete often sends a billable request on every keystroke. Wait for a short pause and a few characters, use session tokens so searches can be billed together when a place is chosen, restrict your key to your site and the APIs you use, set daily quotas, and cache only what the provider's terms allow.

Read the fix

Keeping it running · 4 minutes · Pro

The password in the logs

To debug a sign-in bug, your AI added a log line. Weeks later you open your hosting logs and see customers' passwords in plain text.

Is it dangerous to console.log request bodies?

Yes. Logging a whole request body copies everything the user sent, including passwords and tokens, into your hosting logs, where teammates, log services and anyone with a stolen login can read it. Log what happened, such as a user id and outcome, never request bodies. If secrets reached the logs, delete them and protect affected users.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Authentication

Checking who someone is, usually by signing in.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

Session

The app's memory that you are signed in, kept for a while so you don't log in on every page.