What token use for client side requests to strapi endpoints?

They can be as long or complex as needed, you could also build in an automatic generation of them. So long as they are only called from a server side frontend (Next/Nuxt) and not a client side one (React/Vue) then you should be fine.