Any string that grants access on your behalf — an API key, a database password, a signing token. If someone else gets hold of it they can act as you, which is why secrets must never live in your code.