Access Token
A short-lived, scoped credential a client presents to a resource server to call an API on a user's behalf — proof of permission, not proof of identity.
Access tokens are meant to be used often and exposed — attached to every API call — so they’re deliberately short-lived, usually expiring in minutes. When one expires, the client uses a longer-lived refresh token to get a new one, so the user isn’t asked to re-approve access constantly.