What are Canaries, and how do they Work?
A Canary token alerts you to the presence of an intruder who has found the token. It's like a username and password that doesn't belong to an actual user but an intruder who stumbles across it would have no way of knowing that. It is actually a genuine set of credentials, but to one of our protected systems not to one of yours.
An attacker is very likely to attempt to use it to try to penetrate further layers of security. And when they do, an alert is triggered, warning you of their presence.
Canaries are sometimes also known as sentinels, or decoys, because of this way they detect intrusion.