Log in on phone A below, then copy its token to phone B. Watch B become you.
Log in on A, then copy the token to B
—
—
- server log — nothing yet
The password is checked once. After that the token is you— whoever holds it, on whatever phone. That's why apps have "log out everywhere", and why a token in the wrong place is as bad as a password.
You don't resend your password every tap. After login the server hands your device a [token](/what-is-a-token-2026), and every request just carries it.
Think of a wristband at an event: your ID is checked once at the door (that's login), then you flash the band to get back in. The token is the band.
Supabase describes what's issued: "A session is represented by the Supabase Auth access token in the form of a JWT, and a refresh token which is a unique string." A JWT is just a signed, readable token.
Two tokens, two jobs
What it's for
- Access token
- Sent with each request to prove the session
- Refresh token
- Used to get a new access token
How long it lasts
- Access token
- Short: about 5 minutes to 1 hour
- Refresh token
- Long, but usable only once
Wristband analogy
- Access token
- The band you keep flashing
- Refresh token
- The receipt that gets you a fresh band
Supabase: "Access tokens are designed to be short lived, usually between 5 minutes and 1 hour while refresh tokens never expire but can only be used once." Short access tokens limit the damage if one leaks.
Here's the risk the sandbox shows: the token IS the proof. Supabase notes a session "lasts indefinitely and a user can have an unlimited number of active sessions on as many devices" by default, so anyone who copies your token is treated as you until it expires. That's why tokens travel only over HTTPS, never in a URL or a log, and why a real logout revokes them.
Try it with the rules off. In the sandbox, use the steal step: log in on A, copy its token to B, and ask for orders on B. B never logged in, but the token is all the server checks.
Check yourself
0/4 got itSaved on this device only. No account, no streaks.
Next in who are you: What is 'Sign in with Google'?.
