Logging In and Storing a Token

A hotel checks your identity once at the front desk and then gives you a key card. For the rest of your stay, you show only the card, and it stops working when your stay ends. Many APIs treat your app the same way. The user logs in once, the server returns a short piece of text called a token, and the app sends that token with each later request as proof of who the user is. Checking who a user is in this way is called authentication.

So far, the requests in this chapter have reached public addresses that anyone can read