Suppose we have 2 webapps, appA and appB. They communicate via REST. Say for example, when appA updates let's say, a file, it should inform appB via REST and so on.
I was thinking, how do I make this secure? I mean, what if an ordinary user got the api url and started sending requests? I was looking around the internet and I found out I could secure this through tokens, but how do tokens make it secure? I mean, what if the user got hold of the token and the api url? Wouldn't that be game over?