A supervisor token is a high-privilege bearer credential used by Home Assistant’s Supervisor control plane. It can authorize sensitive actions such as managing add-ons, backups, services, and other instance-level operations. Because it functions as a bearer secret, anyone who obtains it may be able to act with the same authority as the trusted component that owns it.
In cyber security, supervisor tokens matter because they sit at a privilege boundary. If attacker-controlled input, logs, environment data, or a vulnerable helper process exposes the token, a narrow bug can turn into full administrative control. Defenders protect these secrets with least privilege, strict process isolation, careful redaction, and rotation when exposure is suspected. Treating the token as a crown-jewel credential helps prevent convenience features from becoming a path to escalation.