An authentication secret is sensitive material that proves a user, service, or device is allowed to act as a trusted identity. Common examples include passwords, session tokens, API keys, private signing keys, and refresh tokens. These values are usually meant to stay hidden from attackers and from ordinary users.
In cyber security, authentication secrets matter because stealing one can bypass the normal login process. An attacker who captures a valid token or signing key may impersonate an account, mint fake sessions, access mailboxes or APIs, or extend access after a password is changed. Defenders protect these secrets with encryption at rest, strict file permissions, hardware-backed key storage, short token lifetimes, rotation, and careful logging review. If a server is compromised, investigators look for unusual reads of key files, token stores, or authentication databases because secret theft often turns a single intrusion into broad account takeover.