An App Certificate is a randomly generated string provided by Agora for enabling token authentication. It is one of the required arguments for generating an RTC or RTM token.
It is important to safeguard the developer App ID and App Certificate, as they are used to implement real-time audio and video call functions in apps, and all ll charges incurred by the calls are applied to the developer's account. Agora recommends storing the App Certificate on the application server, not on the client.