A CSRF (Cross-Site Request Forgery) token is a unique, secret, and unpredictable value generated by a server to protect against CSRF attacks. These tokens are used to ensure that the requests a user makes to a web server are intentional and not the result of a malicious action by a third party.