Glossary
Honeytoken
A honeytoken is a fake credential, API key, or record deliberately placed somewhere an attacker exploring a compromised system might find it, with no legitimate purpose of its own — nothing in normal operation should ever attempt to use it. Because there's no legitimate reason for it to be touched at all, any use of it is a near-certain signal that something unauthorized is happening, without the false-positive noise that most other detection signals carry.
Its value depends entirely on staying indistinguishable from a real credential or record to whoever finds it, and on the alert it triggers actually reaching someone who acts on it quickly — a honeytoken that fires into a log nobody reviews provides the detection opportunity without any of the benefit.