The token identifies the installed dashboard agent. It is separate from your account login, VPS password and AI key.
The connection permits defined operations, rather than arbitrary remote commands. Keep tokens private and use the supported disconnect and reconnect process when changing access.