# token
The token mentioned in "apifm" generally refers to the login credentials used by users to read or operate their own data.
In the Frontend API docs, all data interfaces involving users require token parameters, and the system uses tokens to identify which user it is.
For example, to read user balances and read user order interfaces, tokens must be passed in. Different users have different tokens, and the system can identify the corresponding users through the tokens.
You can find any login interface in ["Frontend API docs"](#), and you can get this token after successful login.
#X-TOKEN
The X-TOEKN mentioned in "apifm" generally refers to the credentials after the administrator logs in, which is used to call the backend api interface.
In the Backend API docs, all interfaces that administrators have permission to call need to pass in X-TOEKN.
In other words, as long as you have X-TOEKN, you can manipulate your background data at will, so please be sure to keep your X-TOEKN properly and never leak it. Never use X-TOEKN in front-end code. Save X-TOEKN otherwise it will cause serious security problems.
Please be sure to obtain X-TOEKN on your own server, or somewhere you can absolutely guarantee that it will not be compromised.
You can find any login interface in ["Backend API docs"](https://user.api.it120.cc/). After successfully logging in with the administrator account information, you can get X-TOEKN
# access_token
The access_token mentioned in "apifm" generally refers to the access_token obtained by the mini program/subscription account/service account/enterprise account through the open platform they provide, which is used to subsequently call the interface of their open platform.
Here is an explanation of the access_token of the mini program:
The mini program stipulates that access_token is obtained through appID and secret, and the validity period is 2 hours. After 2 hours, a new access_token needs to be obtained again; at the same time, if the access_token is reacquired, the original access_token will become invalid immediately.
This will cause a big problem. After you fill in the appID and secret on the "apifm", you will not be able to use the appID and secret to obtain the access_token elsewhere. Otherwise, the access_token on the "apifm" will be invalidated by you, and the two places will compete with each other for the validity of the access_token.
So, what if you need to use access_token again?
You can directly read the available access_token through the interface in ["Backend API docs"] (https://user.api.it120.cc/) provided by "apifm":
## WeChat Mini Program
## WeChat public account
## Toutiao Mini Program
