title: why isn't it possible to steal an access token?
body: <p>I'm learning OAuth and I have a question in head I can't find an anwser..</p>
  
  <p>I understood request token to authorize or not an application to use the API. But once the user got an access token, what happens if someone steal his access token?</p>
  
  <p>Imagine that we have something like <a href="http://www.example.com/api/article/1?access_token=" rel="noreferrer">http://www.example.com/api/article/1?access_token=</a>******access_token******</p>
  
  <p>If I give this url to another user, the other would have my access and so the API isn't protected anymore?</p>