Security tokens for API logins
Key Takeaway
API and desktop client logins from outside the org-wide trusted IP ranges need a security token. A password change or reset makes the old token invalid.
A security token is an alphanumeric code that Salesforce generates for a user, for logins through the API or a desktop client. Security tokens are available in all editions, in both Salesforce Classic and Lightning Experience.
When a login needs a token
If a user logs in through the API or a desktop client, such as Data Loader, from an IP address outside the org-wide trusted IP ranges...
The user needs a security token. These are the only logins that need one.
If a user logs in from an IP address in the org-wide trusted IP ranges...
Salesforce allows the login without a token.
If a user logs in through a browser from an untrusted location...
The user gets an identity verification prompt instead of entering a token.
Adding the user's IP address to the org-wide trusted IP ranges removes the need for a token, because the user can then log in with just the password. Admins need the Manage IP Addresses permission to manage this list from Setup in Network Access.