Why do Flask apps often need both session auth and API token auth?

Flask apps frequently serve human users through a browser and machine clients through APIs. Sessions work well for interactive flows, while tokens suit stateless requests, but each has different lifecycle and security rules. Teams should separate the two planes so browser behaviour, token storage, and revocation are governed independently.