Access Token
Problem
After authorization, the API needs some way to recognize:
This caller has permission to perform this operation.
Sending the user's password with every request would be terrible.
Solution — Access Token
The client receives a temporary credential representing granted access.
GET /photos
Authorization:
Bearer <access-token>
The API validates the token before allowing access.
Core idea: an access token represents temporary authority to access a resource.