A service token is a credential designed for software rather than a human user. It lets an automated system, API client, or AI agent prove its identity to another service without relying on a long-lived password or a permanent shared secret. In practice, a token is usually scoped to a specific application, environment, or workflow, and it can often be rotated or revoked more easily than static credentials.
Service tokens matter because they reduce the blast radius when automation is compromised. If an attacker steals a token, they may gain only limited access instead of full account control. Defenders use them to enforce least privilege, separate machine access from human logins, and support auditing and revocation. In real attacks, weakly protected tokens are often abused through secret leakage in logs, code repositories, or compromised agents. Strong defenses include short lifetimes, narrow permissions, storage in a secrets manager, and policy checks before the token can call sensitive tools.