Token-only vs. login-token authentication

Question

While working on the auth schema for my application's API, I had a question pop in my head.

Is there a difference between authenticating by token alone, or by a login-token pair? Right now, my token generator does use the user's login, and that's why I've been thinking about a single parameter in the API request responsible for the user's logging in.

However, while not being an infosec expert, I can't help but think that this might be less secure than asking the user for both his login and his token, as in theory a malicious user, coming into a possession of someone else's token might be able to use it.

Another factor in this is that the specifications require the tokens to provide permanent access, as in they cannot expire.

So to re-iterate: is a login-token pair being required with a request going to provide more security opposed to the token being the only required thing?

Edit 1: It seems to me also that if I were to use the pair, it would be too much like regular login-password auth. Am I wrong in thinking that?

Answer 1

If you are using tokens to provide permanent access, then tokens are not very different from your userid. They become even less secure than a normal password because the user at least has an option to change their password regularly.

As for login token pair vs token being the only required thing, I am borrowing the accepted answer from a related question: Two passwords from one account

Not really. It's essentially one password, with a press of the return key as one character.

It adds complexity to the log in process, which isn't generally a good thing (users would probably choose one good password, and one quick to type password). Don't forget @AviD's rule: "Security at the expense of usability, comes at the expense of security"

Depending on how the passwords were stored, they would slightly decrease the ability of attackers to brute force accounts, since an attacker would need to break both parts. I doubt that this balances out the usability issue though.

Answer to your Edit, yes. It will be similar to regular login password authentication.