A signed or opaque string that grants SCOPED access to one thing — a guest tracking link, a QR pass validated at a scanner, a portal magic-link, or an API key. Each token unlocks only what it's scoped to and, where time-limited, stops working once it expires.
See also: Magic link, Pass, Tracking link, Webhook