oauth2.0如何传递访问令牌

Question

I am working on integrating OAuth2 to a REST API and I would like to know how am I supposed to send the access_token parameter for the requests.

Example:
My server accepts two routes:
POST /write
GET /read

For /write, am I supposed to put the access_token in the POST?
curl http://api.localhost/write -d 'access_token=[ACCESS_TOKEN]'

For /read, am I supposed to put it in the GET?
curl http://api.localhost/read?access_token=[ACCESS_TOKEN]

Or in both cases, is it supposed to be sent through POST?

Thanks,
Gasim

Answer 1

With OAuth, the token is generally passed in the request headers. You may wish to try something similar to the following, for both POST or GET:

POST: curl http://api.localhost/write -H 'Authorization: Bearer ACCESS_TOKEN'

GET: curl http://api.localhost/read -H 'Authorization: Bearer ACCESS_TOKEN'

The value part of the Authorization key/value pair can vary by REST service provider. With Github , for instance, the header key/value pair looks like this:

curl -H "Authorization: token your_token" https://api.github.com/repos/user/repo

You may need to consult the webservice provider docs for details.