Called first thing after an input method is created, this supplies a unique token for the session it has with the system service. It is needed to identify itself with the service to validate its operations. This token must not be passed to applications, since it grants special priviledges that should not be given to applications.

Note: to protect yourself from malicious clients, you should only accept the first token given to you. Any after that may come from the client.

[Android Documentation]