Mastering OAuth 2.0

Use your access token to make an API call

Now that we have the ability to fetch access tokens from the service provider using either the implicit grant flow or the authorization code grant flow, let's finally utilize these tokens to access protected resources. This is done via API calls to the service provider, in our case, Facebook. When making an API call to request access to a protected resource, the respective access token must be provided as well. This allows the service provider to validate the token by ensuring that the token has not expired or been revoked and that its associated scope covers the requested resource.

There are three prescribed methods for passing the access token in an API call. Those methods are:

• Authorization request header ...