title: Is a Plaid access token a secret?
body: <p>The <a href="https://www.plaid.com/docs/quickstart/#glossary" rel="nofollow noreferrer">Plaid Link API documentation</a> states that the result of a successful Plaid link returns a <code>public_token</code> with the following properties:</p>
  
  <blockquote>
    <p>Once a user has successfully onboarded via Plaid Link, the module will
    provide a public_token. This is in contrast to typical Plaid API
    requests, which return an access_token.</p>
    
    <p>Is safe to expose in an app or browser</p>
    
    <p>Cannot be used to retrieve account and routing numbers (for auth) or transactions (for connect) directly</p>
    
    <p>Can be exchanged for a Plaid access_token via the
    /exchange_token endpoint.</p>
  </blockquote>
  
  <p>Presumably, this is in contrast to the <code>access_token</code>, which implies that the <code>access_token</code> is a secret. However, as far as I can tell, <a href="https://plaid.com/docs/api/#overview" rel="nofollow noreferrer">every Plaid endpoint</a> that takes an <code>access_token</code> also requires the client's ID and <code>secret</code> value.</p>
  
  <p>Assuming the <code>secret</code> is in fact kept secret, is it theoretically safe to expose the access tokens? If not, what am I missing? If so, what's the point of the public tokens?</p>