After logged in to application, why one should use "access token" instead of simply using "user name", to call further APIs ? How it is more secured with access token ?


Let's say you are logged in to application A, and you want to call an API of application B.

Application B, in general, doesn't know which users are logged in.

If that API was called using user_name, one could generate a request pretending to be another user, without proving to be logged in to application A.

The access token solves this issue.

Moreover, access tokens can expire, which mean that even authorized users can only access that API, say, from 9 to 17. Schemes that only use user_name are not that flexible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.