@Override
    public boolean equals(Object o) {
        if (this == o) return true;
        if (o == null || getClass() != o.getClass()) return false;
        Token token = (Token) o;
        // We assume that domain+fingerprint suffices for equality check.
        // If underlying secret bytes checking is added it MUST use SideChannelSafe.arraysEqual()
        // to avoid leaking secret data via timing side-channels.
        return Objects.equals(domain, token.domain) &&
                Objects.equals(fingerprint, token.fingerprint);
    }
<p>A token represents an arbitrary, opaque sequence of secret bytes (preferably from a secure
random source) whose possession gives the holder the right to some resource(s) or action(s).
For a token to be recognized it must be presented in its entirety, i.e. bitwise exact. This
includes any (optional) text prefixes.
</p><p>
Only the party <em>presenting</em> the token should store the token secret itself; any
parties that need to identify and/or verify the token should store <em>derivations</em>
of the token instead (TokenFingerprint and TokenCheckHash, respectively).
</p><p>
A Token <em>object</em> is bound to a particular TokenDomain, but any given secret token
string may be used to create many Token objects for any number of domains; it is opaque and
not in and by itself tied to any specific domain.
</p>
security-utils/src/main/java/com/yahoo/security/token/Token.java