So if a user authenticates to the site using a username/pw, they get a session token which is passed back to the server to validate who they are.
However when you use an API like twitter or 4square, you have both a token and a secret. What extra value is there in adding an api secret to the api token especially if you are going to send both of them in the URL.
The only plausible thing I've been able come up with is it makes the numberspace REALLY big, but a 128bit token already has a HUGE numberspace, so that makes be believe that is probably no the reason for the extra value.
So why have 2 values, both of which are transmitted in each request?