[roasbeef]

Exactly! Within the protocol, an atomic exchange happens where the user satisfies a payment over Lightning, and they receive the second half to "complete" their authentication token.

If this token is say 10 sats, then maybe it's just basic spam prevention for you to make an account on some online form. If it's say 100k sats, then maybe the LSAT itself also functions as a sort of licensing key or guards a download of some other artifact/file.

From the PoV of the application logic, all this happens "before" the main request even reaches the handler. If you're familiar with Python, it's as if you had a decorator on a handler that handled the auth+payment and only passed on valid requests once everything has been satisfied. Going even further, applications can start to utilize the power of macaroons to create LSATs that: expire after 24 hrs, or allow you to take your credential and make it read-only to give to your friend.