Glossary
TokenRequest
The Kubernetes API (serviceaccounts/token subresource) that mints short-lived, audience-bound tokens for a service account, as used by kubectl create token.
TokenRequest is the API behind the serviceaccounts/token subresource. The kubelet uses it to obtain the projected tokens mounted in Pods, and kubectl create token <name> uses it to mint a token by hand. In the audit log it appears as a create on serviceaccounts with subresource token; at Request level the body shows the requested expirationSeconds and audiences.
An interactive client minting a long-lived token for a privileged service account is a persistence step. Such tokens stay valid until they expire unless the service account (or the object the token is bound to) is deleted. See token theft.