DAT (Distributed Access Token) is a distributed authentication token: every server that issues or verifies sessions only needs to share a single specification. It is built on fixed-width binary fields, so values are read and written directly by offset with no parsing cost, and the protocol itself separates the issuance window from the TTL so that certificate rotation (key rolling) can be enforced regardless of language or implementation.

The DAT Certificate Management Service (CMS) automatically handles the creation, propagation, and expiration of certificates across the entire cluster on a scheduled cron job, so keys can be rotated safely without tokens failing verification because several servers have not finished synchronizing the new certificate yet.

Only the login server gets certificates it can issue with; the content servers get verify-only certificates and just check the DAT that comes in. The user deals with a single service, and a content server never has to talk to the login server.