It is about authorization: what a token may do. The main roles are the user, the client app, the authorization server and the resource server (the API).
OAuth 2.0
A framework that lets an app get limited access to an API on a user's behalf through tokens, without seeing the user's password.