 <p>The access token returned in the call to the OAuth2 endpoint identifies the caller and privileges (which api calls you can make). This is required for any of the api calls (REST) to create payments, execute, refunds etc. Some calls require more privileges than others, i.e. you need to have requested more information or provided more credentials when createing the access token.</p> <p>The token returned in the URL identifies the payment, this is so that when a user is redirected back to your site, you have a way to identify which payment has been redirected back to your site and identify the proper information, i.e. execute the correct payment.</p>