Use your access token to make an API call

Now that we have the ability to fetch access tokens from the service provider using either the implicit grant flow or the authorization code grant flow, let's finally utilize these tokens to access protected resources. This is done via API calls to the service provider, in our case, Facebook. When making an API call to request access to a protected resource, the respective access token must be provided as well. This allows the service provider to validate the token by ensuring that the token has not expired or been revoked and that its associated scope covers the requested resource.

There are three prescribed methods for passing the access token in an API call. Those methods are:

• Authorization request header field

• Form-encoded body parameter

• URI query parameter

Tip

Only for bearer tokens!

These three methods are only for tokens of the type bearer, which is the only type of token we have dealt with in this book. However, there are other token types that...