It’s an access token not a decryption key. The difference is you can’t download anything without the token, and the provider isn’t storing or serving ciphertext

It’s an access token not a decryption key. The difference is you can’t download anything without the token, and the provider isn’t storing or serving ciphertext. From an implementation standpoint, it means it’s trivial to expire or revoke to token without having to touch the data it grants access to. It can be an entirely separate authentication service.