Which of the following statements about token-based authentication is true?

Token-based authentication is a method that enhances security by allowing users to authenticate without transmitting their usernames and passwords with each request. This method often employs tokens that are generated upon successful authentication and can serve as proof of a user's identity for a specific session.

The statement that token-based authentication is not affected by PCI compliance is accurate because PCI compliance primarily concerns the protection of cardholder data and secure transmission of sensitive information. Token-based authentication helps meet PCI DSS (Payment Card Industry Data Security Standard) requirements by reducing the need to store and transmit credit card data, thus enhancing security. It minimizes the risk of exposing sensitive information and allows applications to operate without directly handling card information, making adherence to PCI compliance more manageable.

In contrast, the other statements present incorrect characteristics of token-based authentication. Usernames are not stored in plain text as they are typically kept secure, token keys can be temporary or long-lived depending on how they are configured, and the need for frequent password changes is absent since the authentication relies on tokens instead of traditional password methods.