Comment by stop50

Its part of the authorization. The only thing i can think of is the use of JWT for auth. you log into one and get an jwt and the application checks it.