# How to lock down an API token to only access what our application needs

**URL:** <https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305>\
**Category:** Questions\
**Created:** [May 19, 2021, 3:29pm UTC](https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305 "2021-05-19T15:29:21Z")\
**Posts on this page:** 3\
**Page:** 2

<div class="post-metadata">

**Author:** ![AlexandreUnca](https://avatars.discourse-cdn.com/v4/letter/a/a9adbd/32.png) [@AlexandreUnca](https://devforum.okta.com/u/AlexandreUnca)\
**Post date:** [July 25, 2023, 7:43am UTC](https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305/21 "2023-07-25T07:43:44Z")

</div>

Yes! It works.  
thanks.

what should be my work flow with angular and a API app?  
Right now i send my auth bearer like that to secure my api:  
const authToken = this.\_oktaAuth.getAccessToken();  
req = req.clone({ setHeaders: { ‘Authorization’: `Bearer ${authToken}` } });

Do i need to send in the header or body the token that i generated or i send it in authorization header?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [July 26, 2023, 4:06pm UTC](https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305/22 "2023-07-26T16:06:30Z")

</div>

Typically, it gets sent as a Bearer token in the Authorization header, so what you have right now looks good, provided of course that your API is then [validating the token](https://developer.okta.com/docs/guides/validate-access-tokens/dotnet/main/) when it receives it to check that the requestor is allowed to access a given resource

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 13, 2024, 12:51am UTC](https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305/23 "2024-02-13T00:51:31Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.

[Previous page](https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305.md?page=1)