Tokens & the Keychain

How the backend knows it's you

HTTP has no memory. Every request the app sends arrives at the backend as a stranger knocking on the door — so how does GET /bookings know whose bookings to return?

With a bearer token. When you log in, the backend checks your password once and hands back a long signed string (you saw it in Module 3: AuthResponse.accessToken). From then on the app attaches that string to every request, in an HTTP header: Authorization: Bearer <token>. Whoever bears the token is treated as you — no password re-sent, ever.

You already built the sending side in Module 7 — APIClient has a bearerToken property, and its request helper does this: