Definition
An email security token is a secret credential used to authenticate access to email systems and APIs, such as an SMTP API key, an OAuth access token or an app password. Tokens authorize actions like sending mail or reading data.
Because tokens grant access, they must be protected: stored in secret vaults rather than code or files, scoped to the minimum permission, rotated regularly, and revoked when no longer needed or if compromised.
Leaked tokens are a real threat, letting attackers send spam or read mail and damaging your reputation. Treat every token like a password, audit who holds them, and use environment variables or a secret manager for storage.
Was this useful?
Related Glossary Terms
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Email Deliverability
Email deliverability is the ability to land in the recipient's inbox rather than the spam folder. It depends on sender reputation, authentication, list quality, and content practices.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
DMARC (Domain-based Message Authentication)
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that builds on SPF and DKIM to prevent domain spoofing and provide reporting on authentication failures.
Frequently Asked Questions
It is a secret credential, like an API key, OAuth token or app password, used to authenticate access to email systems for sending or other actions.
Keep tokens in a secure secret manager or environment variables, never in code or exposed files, and limit them to the minimum required permissions.
A leaked token lets attackers send spam or read mail through your infrastructure, hurting your reputation. Rotate tokens regularly and revoke any that may be compromised.