title: OAuth's tokens and sessions in REST
body: <p>The other minute I read an article on OAuth. It described especially the tokens being exchanged between client and service provider during a series of requests.</p>
  
  <p>The article also mentioned that OAuth gains significant popularity in RESTful APIs as authorization layer. As I understood, REST should be kept completely stateless.</p>
  
  <p>The question: Doesn't this repeated token exchange torpedo REST's "being stateless" principle? IMHO the tokens can be seen as a kind of session ID, can't they?</p>