package com.dexels.oauth.api;

/**
 * An AccessToken can be used by a client to access an API.
 * 
 * This token is of type 'bearer'. It is typically short lived (for instance 1
 * hour) and can be refreshed with a {@link RefreshToken}. The AccessToken code
 * should be provided as HTTP Authorization header for every API call that needs
 * authentication.
 * 
 * One could issue longer lived tokens for use cases where (i) the chance that
 * the token gets compromised is small (e.g. for a trusted (internal) server
 * accessing the API) and (ii) implementing a refresh is too much work.
 * 
 * An application running on a user device (mobile phone, web browser, etc.)
 * should always use short lived tokens.
 * 
 * The AccessToken is only valid for a single {@link Client}.
 * 
 */
public interface AccessToken extends Token {
	public static final String TOKEN_TYPE_BEARER = "bearer";
}