There are many ways in which you can secure your tokens from being used by neverious 3rd parties, here are a couple examples:

You should ensure that the token has been signed to avoid tempering. A common tool for this is JWT which signs the token with a private key, this ensures that if someone makes a change to the content of the token it will no longer match its validation hash. 

You should provide an expiration time with your token. Doing so will ensure that a token is only valid for a specific amount of time and if any 3rd party gains access to it they will only be able to use it until the expiration date has passed.

On your server you should also keep track of the location where the token was last used, this can be done through a package like `ip2location-nodejs` which will give you a rough location estimate of the IP address's location. If the location has changed too much since the last usage you can invalidate the token and ask the user to re-authenticate so you can be sure that they are still them.

When the user wants to make large changes to their account or content like changing their password, E-Mail, billing data, deleting content and such you should always ask the user to re-authenticate and prove they are still themselves and are sure they want to perform those actions. This would prevent a neverious 3rd party from performing these actions without the user's consent.

There are many more security considerations to take care off and I would advice you to do some extra research online to find the most up to date security practices to use.
spam fails_task lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor helpfulness creativity violence