CODEWITHSUNDEEP
oauth
John Bledsoe
John Bledsoe

Reputation: 17682

Why does OAuth provide both an access token and an access token secret? Why not just a single value?

Why does OAuth include both an access token and an access token secret as two separate values? As a consumer or OAuth, all of the recommendations that I have seen indicate that I should store the token and secret together and essentially treat them as one value.

So why does the specification require two values in the first place?

Upvotes: 20

Views: 4247

Answers (2)

Ripu Daman Bhadoria
Ripu Daman Bhadoria

Reputation: 2572

There are 2 secrets, one is token secret and other is consumer secret. Secrets are used to sign the requests (to generate the oauth signature) but not transmitted in the request header where token is sent in the header to identify the client and verify if it has access.

Upvotes: 0

yydl
yydl

Reputation: 24474

Actually, the access token secret is never transmitted to the provider. Instead, requests transmit the access token, and then use the secret to sign the request. That is why you need both: one to identify, and one to secure

Upvotes: 22

Related Questions