A short-lived token is a temporary credential that grants access for a limited time, then expires automatically. In cloud and CI/CD environments, these tokens are often used instead of long-lived API keys because they reduce exposure: if a token is stolen, the attacker has only a small window to use it before it becomes invalid.
In real attacks, malware on developer endpoints or build runners may try to capture active session tokens, cloud identity tokens, or deployment credentials from memory, files, or browser sessions. Defenders use short-lived tokens as part of least-privilege access, paired with rotation, token binding, and strong authentication. They are not a full defense on their own, but they make credential theft less valuable and can limit lateral movement when an endpoint is compromised.