While working on the auth schema for my application's API, I had a question pop in my head.
Is there a difference between authenticating by token alone, or by a login-token pair? Right now, my token generator does use the user's login, and that's why I've been thinking about a single parameter in the API request responsible for the user's logging in.
However, while not being an infosec expert, I can't help but think that this might be less secure than asking the user for both his login and his token, as in theory a malicious user, coming into a possession of someone else's token might be able to use it.
Another factor in this is that the specifications require the tokens to provide permanent access, as in they cannot expire.
So to re-iterate: is a login-token pair being required with a request going to provide more security opposed to the token being the only required thing?
Edit 1: It seems to me also that if I were to use the pair, it would be too much like regular login-password auth. Am I wrong in thinking that?