After logged in to application, why one should use "access token" instead of simply using "user name", to call further APIs ? How it is more secured with access token ?
Let's say you are logged in to application A, and you want to call an API of application B.
Application B, in general, doesn't know which users are logged in.
If that API was called using
user_name, one could generate a request pretending to be another user, without proving to be logged in to application A.
The access token solves this issue.
Moreover, access tokens can expire, which mean that even authorized users can only access that API, say, from 9 to 17. Schemes that only use
user_name are not that flexible.