The authentication token is a secret baked into an Apple Wallet pass at signing time, declared in pass.json next to the web service URL. When the member's device talks to the pass's web service, registering, asking for changed passes, fetching a fresh copy, it presents this token as proof that it genuinely holds the pass, and the server rejects calls without it.
The token and the web service URL are a package deal: a pass carries both or neither, and a pass carrying neither is static, frozen as it was on the day it was added. Everything live about a pass, device registration, every push update, rides on this pair. The token is per pass, chosen by the issuing platform, and must be reasonably long; it is not something a member ever sees or types.
Its weight shows at migration time. The token is baked into the signed pass, so it cannot be changed remotely: moving a program to a new provider means the new web service must accept the tokens already living in members' wallets, which makes exporting them, alongside serial numbers, a non-negotiable part of pass migration. A platform that will not hand over tokens has effectively locked the installed base.
The token authenticates the device to the server; it is unrelated to the certificates that sign the pass or the keys that encrypt NFC taps. Keeping those three straight, signing identity, tap encryption, update authentication, resolves most confusion about which secret does what in a pass program.