I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token.
Basically they provide you with a read-only (for the most part) token that you can get by a POST request and providing the parameters:
client_id(this is publicly known)
grant_type(which would be "implicit")
In their docs, they say that implicit tokens are generally for front-end applications, however I'm not sure what the point of this is. What is the benefit if the client_id is exposed thus allowing anyone to generate these tokens? On top of that, they are only allowed access to non-sensitive data. It is odd to me because visitors to your shop would be given a token just to visit your site and read your listings. It seems more beneficial to not have a token at all for reading data but have one if you plan to write or view more sensitive data.