In the OAuth 2.0 framework, an access token is a string that represents a specific authorisation: which resources can be reached, with which permissions, and for how long. The app presents it to the API, usually in an Authorization header as a bearer token, and the API checks it before responding. In Supabase, Firebase and most auth providers the access token is a JWT.
Bearer means that whoever holds the token can use it. No password is needed. That is why access tokens are kept short lived: Supabase's documentation describes them as designed to last between 5 minutes and 1 hour. A stolen token then stops working soon after. The usual mistakes are setting very long lifetimes to avoid dealing with refresh, putting tokens in URLs where they end up in logs and browser history, printing them to the console, and storing them where any injected script can read them.
Send tokens only over HTTPS and only in headers or secure cookies. Keep lifetimes short and rely on the refresh token to obtain new ones. On the server, verify the token's signature and expiry on every request and take the user's identity from the verified token, never from a user ID in the request body.
GET /api/orders HTTP/1.1
Host: app.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...