In the course of designing and using web APIs, you’re bound to encounter tokens. They are everywhere: access tokens for OAuth, CSRF tokens for security, reset tokens for passwords. Because of their ubiquity, they’re easy to overlook, but token design actually plays a huge role in shaping your application architecture. This presentation surveys API architectural archetypes through the lens of tokens, and how they can facilitate (or inhibit) your platform’s scalability.