Tokens 101

HTTP forgets you instantly

Every request your app sends is, as far as the backend is concerned, a stranger knocking on the door. There's no built-in "remember me" in HTTP — so how does GET /bookings know whose bookings to return?

The answer is a bearer token. Log in once, and the backend checks your password, then hands back a long signed string — you'll meet it as AuthResponse.accessToken when we get to PawWalkApi.kt. From then on, every request the app makes carries that string in one HTTP header: Authorization: Bearer <token>. Whoever bears the token is treated as you. No password gets re-sent, ever.

This module answers three questions in order: where does the token live between app launches, how does it get attached to every request automatically, and how do the login/signup screens create one in the first place?