security//token

A token is a string that proves something: identity, permission, or both. Three types show up in an app with OAuth:

A token is a string that proves something: identity, permission, or both. Three types show up in an app with OAuth:

Session tokenIt says I'm Carmen. Supabase generates it when the user authenticates and stores it in the browser's cookies, so every frontend-to-backend request carries it automatically. It is what lets RLS know who to filter for.

Access tokenIt says I have permission to read Carmen's Gmail. Google generates it during OAuth, and it expires fast (about an hour). It is stored server-side in the profiles table in Supabase and never reaches the browser; the backend uses it to call the Gmail API.

Refresh tokenIt says give me another access token without bothering Carmen. It also comes from Google and also stays server-side. When the access token expires, the backend uses it to get a new one, and the user never notices.

Session tokens travel via cookies, while Gmail tokens live only on the server. Identity travels, secrets don't.