How does a "session" exist without "credentials" that have to be verified every time? Http is stateless so even non-native authentication solutions have to deal

How does a "session" exist without "credentials" that have to be verified every time? Http is stateless so even non-native authentication solutions have to deal with these problems. Why can't your server generate a "session token" and require it to be passed using basic auth? Wouldn't you want to hash these "session tokens" on your server in case it becomes compromised?