How should a client pass a facebook access token to the server?

Question

On every call to my REST API, I require clients to pass user's facebook access token, which authenticates the user. What's best practice for passing this token?

1. maybe as a parameter behind the HTTP question mark

   GET /api/users/123/profile?access_token=pq8pgHWX95bLZCML 

2. or somehow in the header of the request, similarly to HTTP basic authentication

3. maybe a third option? (I've excluded passing it in a JSON because I want the token get passed in GET calls as well, so JSON wouldn't fit there I think)

Answer 1

If you look at the API endpoints provided by all popular OAuth providers (Google, Facebook, Pocket, Git etc), you'd see that they all have HTTPS endpoints.

The ways in which you can pass an access token to the provider are -

i) As Query Parameter -

https://yourwebsite.com/api/endpoint?access_token=YOUR_ACCESS_TOKEN

ii) In the request header -

 GET /api/users/123/profile HTTP/1.1  Host: yourwebsite.com  Date: Tue, 14 May 2013 12:00:00 GMT  Authorization: <YOUR_ACCESS_TOKEN> 

These two are approaches that are generally supported by most APIs. You can think of doing the same.

iii) Pocket API does not use GET at all. They use POST for all their requests, even for retrieving data. Check this link to see their documentation. Notice that they use POST for retrieving data and pass JSON parameters.