API token hashing uses HMAC-SHA256 on high-entropy tokens (256-bit random), not passwords. Actual password hashing uses bcrypt.