I am building an API that will utilize access tokens so that I can track usage among various departments and for access control. My plan is to utilize the HTTP verbs appropriately -
GET will retrieve information,
POST will add,
DELETE will delete, etc.
My question is, how should I handle access tokens on the GET calls?
Is to provide the access token as part of the query string:
/api/users/?token=ACCESSTOKEN. The problem I have with this is that the ACCESSTOKEN appears in server logs. This method will also be different than POST or DELETE requests that have the token passed via the body.
Provide a body to the request (as you do in a
POST request) and one of the parameters is the token. My issue here is that other developers in my company are telling me this isn't a "true GET request" because I'm passing data. The url they call simply looks like this
/api/users/ and they provide
token=ACCESSTOKEN within the body.
GET and force everything to be a
POST. I don't like this idea because for many of these API calls, I'm not creating new resources. I'm simply returning data that just happens to sit behind an API that requires authorization.
Is there an option that I am missing or should refine? I like option 2, but am sensitive to the concerns of other department developers.