> A session token has such limited power compared to secret key Does it though? Sure, it has different threat models, and you may choose to assign it different

> A session token has such limited power compared to secret key Does it though? Sure, it has different threat models, and you may choose to assign it different trust levels, but fundamentally (as I understand it) every session token _is_ a secret key, with added benefits.