A password or token is persisted in UserDefaults, which is unencrypted.
Store credentials in the Keychain with an appropriate accessibility class instead of UserDefaults.