I'm connecting a Salesforce ORG with a third party vender through a custom API (they basically wrote it just for us). The API requires you to retrieve a "token" that you pass into other calls through BASIC Authorization.
I was caching this token but would run into an error on the second time I tried to use it. As it turns out, this token can only passed into an API call ONCE. The next API call need to retrieve its own token. Basically this results in two API calls for every one API operation. Salesforce limits the number of callouts you can make per execution context, so this is really not ideal.
I'm wondering if there is any logical reason for doing it this way? Wouldn't just using BASIC Authorization in each operation be just as secure (or un-secure)?