The municipal fleet API has returned an access token to the city’s maintenance app after a successful code grant. How should subsequent protected resource calls be authorized?
Select an answer to reveal the explanation.
Short Explanation
Once you have the badge, wear the badge at the door—don’t make staff re-approve you for every hallway. Resource calls carry the access token; repeating the authorize redirect each GET is not the grant.
Full Explanation
After the token response, the consumer calls the protected API with the access token, typically as Authorization: Bearer. Repeating the authorization redirect on every resource GET is not the authorization-code grant. The code is already spent; consent cookies alone are not the constructed API credential.