Credential.

Credential is the term that unifies passwords, passkeys, certificates, API keys, and OAuth tokens — they are all evidence a verifier checks. The casual conflation of "credentials" with "username and password" is one reason teams underestimate the scope of credential security; a complete credential inventory in a modern CIAM deployment typically includes 5-10 distinct credential types per user, plus a comparable set for service accounts.

The distinction between credentials and tokens matters operationally. Credentials are enrolled once and revoked rarely; tokens are minted per session and rotate frequently. Compromise of a credential is a long-tail incident (re-enroll the user); compromise of a token is a short-tail incident (wait for expiration, or revoke the issuing session).