Is the web activation token a password?
No. The token enables the protected loader for the current browser session; the terminal password protects command execution.
Two different jobs
Activation controls whether the protected site loader is exposed to this browser session. Terminal authorization controls whether someone can execute commands. One does not replace the other.
Handle the URL as sensitive
The bridge removes the token from the visible address after successful activation, but you should still avoid sharing it in screenshots, tickets or public logs. Rebuild the protected package if the token is exposed.