A few questions about token-based authentication

I feel like I should get clarification on the basics before I start building stuff with token-based authentication.

Should there only be one token per user? Like, do you just add a auth_token column to the users table in the database? Or is it a many-to-one kind of thing, requiring a whole separate tokens table?

And do I need to do anything to secure these tokens? If the database got leaked then the attacker would have access to every account, no? So I'm guessing I need to mitigate this somehow?

And should tokens last indefinitely?

Thank you!