It's an ID, not an authentication token. If it helps, you can think of it as a username, not a password. It has to be transmitted in the clear or you wouldn't even know who you're talking about.
Doesnt have to be transmitted in the clear; that's exactly what TLS does; allows usernames and passwords to be transmitted with encryption so only the other party can recover them.