Password, Token, Session, OAuth2: What Listings Mean by These Words

Listings describe what you will receive using words taken from developer documentation: token, session, OAuth2. Anyone who has worked with an API has met all three, which is the problem, because on a listing each of them means something narrower and more specific than it does in the documentation they came from.

Getting this wrong is the most expensive mistake available here, because format mismatches are usually total losses rather than partial ones. The account can be exactly as described and still be unusable for what you bought it for.

Password only

You receive: an identifier and a password. Nothing else.

This is the only format with no hidden meaning, and it is worth noticing what it does not include. There is no second factor, which cuts both ways: you can set your own immediately, and so could anybody else holding the same credentials. If the original registrant still has a recovery route, a password is the weakest position you can hold, because it is the one thing a recovery flow is designed to reset.

Fine for signing in occasionally. A poor choice for anything you intend to keep.

Password plus a second factor

You receive: the above, plus something that satisfies the second step. And this is where listings compress three quite different things into one word.

• A shared secret (the seed behind an authenticator app) means you can generate codes yourself indefinitely. This is the strong version.
• A list of backup codes is a finite number of single uses. Once spent, you are locked out unless you have replaced the factor by then.
• A cloud password, as Telegram uses, is a fixed string rather than anything rotating.

The question to ask a listing is which of the three you are getting, because "2FA included" covers all of them and they are not equivalent. A second factor you cannot regenerate is a countdown, not a security feature.

Token or API key

You receive: a credential string the platform issued, usually with no password alongside it.

Here is the gap with the developer meaning. In API documentation a token is typically something you mint yourself and can re-mint at will. On a listing it is a credential that already exists, that you did not create, and that you generally cannot renew. When it expires or is revoked, it is gone, and without the underlying password there is nothing to fall back to.

The second difference matters just as much: tokens usually cannot be used to sign in through a normal web interface. If your plan involved logging in and clicking around, a token does not do that, no matter how valid it is.

Session files

You receive: data representing an already-completed sign-in, such as a Telegram TDATA folder or a .session file, or browser cookies for a web platform.

The critical property, and the one almost nobody thinks about at purchase: a session is a copy, and copies do not exclude each other. Several people can hold the same session simultaneously and all be signed in. Nothing about receiving one tells you whether someone else still has it.

The only way to find out is to look at the platform's list of authorised devices or active sessions once you are in, and end the ones you do not recognise. Treat that as part of receiving the goods rather than as an optional security step, and do it while there is still time to complain.

OAuth2

You receive: a refresh token, plus the client id and secret it was issued against.

This is the format where incompleteness is most common and least obvious. A refresh token exists to exchange for fresh access tokens, but the exchange requires the client credentials it was issued under. Receive the refresh token without them and you have a string that works until the current access token expires and then stops forever.

Everything looks fine at delivery, which is exactly the problem. The check is not "does it work now" but "can I perform a refresh", and those are different tests. Do the second one.

How the market prices format, which is inconsistently

Worth knowing because it affects where it is worth negotiating:

• On Telegram, format is not priced at all. TDATA, session and JSON listings sit at the same level, so there is no reason to accept the wrong one.
• On some mailbox shelves, protocol access is the cheapest attribute measured, effectively free, while verification attributes cost close to double the middle price. A buyer optimising for "my tool can connect" is optimising the free axis.
• On one mailbox shelf the same protocol attribute costs nearly twice the middle price, the only place that inversion appears. Category habits do not transfer.

So the useful generalisation is that there is no generalisation. Read the format's price on the shelf you are actually buying from.

Which mistakes you can come back from

Delivery is instant across the catalogue and the median warranty window is twelve hours, so every check below is available immediately and none of them are available later.

• Recoverable: receiving a format your tool cannot read, if you notice inside the window. It is a clean, factual mismatch against the listing.
• Recoverable if you look: a session someone else still holds, but only if you check the device list rather than assuming.
• Usually not recoverable: an OAuth2 refresh token without its client credentials, if you only tested that the current access token worked. By the time it fails, the window is long closed.
• Not recoverable at all: spent backup codes. There is no version of this that ends well, which is why identifying which kind of second factor you were given belongs at the top of the list.

The Telegram-specific version of this, covering TDATA and session files in detail, goes further into that shelf. The pre-purchase checklist covers the checks around these formats.