Everything in this lesson follows from one distinction: a password proves who you are; a bearer token proves what you're allowed to do, to whoever happens to be holding it. That's why it's stored as a hash instead of kept readable, why it comes with a scope instead of blanket access, and why losing one is a different kind of emergency than forgetting a password — there's no identity check to fall back on, only revocation. The lab that follows this lesson mints a real, scoped Fire token and watches it fail loudly the moment it's used outside that scope.