While working on the auth schema for my application's API, I had a question pop in my head.

Is there a difference between authenticating by token alone, or by a login-token pair? Right now, my token generator does use the user's login, and that's why I've been thinking about a single parameter in the API request responsible for the user's logging in.

However, while not being an infosec expert, I can't help but think that this might be less secure than asking the user for both his login and his token, as in theory a malicious user, coming into a possession of someone else's token might be able to use it.

Another factor in this is that the specifications require the tokens to provide permanent access, as in they cannot expire.

So to re-iterate: is a login-token pair being required with a request going to provide more security opposed to the token being the only required thing?

Edit 1: It seems to me also that if I were to use the pair, it would be too much like regular login-password auth. Am I wrong in thinking that?

  • if a person can manage to catch your token, couldn't he also know your login?
    – Kepotx
    Commented Apr 20, 2018 at 13:19
  • @Kepotx That sounds about right in the most cases, though one should account for social engineering in security and you never know how that sort of attack can go.
    – Ivan T.
    Commented Apr 20, 2018 at 13:37

1 Answer 1


If you are using tokens to provide permanent access, then tokens are not very different from your userid. They become even less secure than a normal password because the user at least has an option to change their password regularly.

As for login token pair vs token being the only required thing, I am borrowing the accepted answer from a related question: Two passwords from one account

Not really. It's essentially one password, with a press of the return key as one character.

It adds complexity to the log in process, which isn't generally a good thing (users would probably choose one good password, and one quick to type password). Don't forget @AviD's rule: "Security at the expense of usability, comes at the expense of security"

Depending on how the passwords were stored, they would slightly decrease the ability of attackers to brute force accounts, since an attacker would need to break both parts. I doubt that this balances out the usability issue though.

Answer to your Edit, yes. It will be similar to regular login password authentication.

  • 1
    Thanks, after taking your answer into consideration, I've decided to implement a token refresh mechanism and with the excerpt from the linked answer I gathered that there isn't a significant difference.
    – Ivan T.
    Commented Apr 20, 2018 at 14:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .