title: Can an OAuth 2.0 access token be used to authenticate a user in another context?
body: <p>I want to know if it is permissible to pass a user's OAuth 2.0 access token between applications and use it as a method of logging them in.</p>
  
  <p>I have an iPhone application that uses the password grant to authenticate a user, and then uses their access token for future requests. The iPhone application is also able to open up our website in a tab, and I want the user to be logged in to our website when this tab opens.</p>
  
  <p>Under the OAuth 2.0 spec, is it permissible to pass that token to the web request and have the the web server authenticate and log the user in for that request?</p>
  
  <p>For example, the browser might open the following location (but use a header, instead of a query string):</p>
  
  <pre><code>https://example.com/account?access_token=foo_bar
  </code></pre>
  
  <p>Alternatively, a dedicated endpoint for OAuth authentication and a redirect could be used.</p>
  
  <p>So in effect, my question is in two parts; can an OAuth 2.0 token be shared between application contexts and can a token be used to authenticate a user in another context?</p>