A county fir-cone catalog web app puts an ID token in the Authorization header when calling a downstream inventory API and receives HTTP 401. What should the developer send to the API?
Select an answer to reveal the explanation.
Short Explanation
Think of the ID token as the app’s nametag for its own session, and the access token as the ticket the API actually checks. Send the ticket, not the nametag.
Full Explanation
ID tokens identify the user to the client application; resource APIs expect a bearer access token with an audience matching that API. Placing an ID token in Authorization commonly yields 401 because the API’s validation rejects the wrong token type or audience. Refresh tokens are for the client to obtain new access tokens and must not be forwarded to APIs.