title: Why is OAuth designed to have request token and access token?
body: <p>In the OAuth protocol, a service consumer will ask a user to authorize a <strong>request token</strong> in the service provider domain, then exchanges the <strong>request token</strong> for a <strong>access token</strong> from the service provider.</p>
  
  <p>I'm wondering why OAuth is designed to have two tokens in the protocol.</p>
  
  <p>Why not just use one single token in this process? That is, the user would authorize <strong>the token</strong>, and the service consumer would retrieve info from the provider with <strong>the token</strong>.</p>