title: Can OAuth access tokens be used as a public ID?
body: <p>My application is essentially a stateless proxy that converts some data fetched from a service into a different format and serves it to the user on-the-fly. Since the data is not confidential, the only method of authentication will be a large, random URL. Nevertheless, the OAuth access token I'll need to store in order to fetch the data does provide some <code>write</code> features, which I'd like to avoid leaking.</p>
  
  <p>My question is whether is it safe to use the access token as a public identifier on the URL and just keep the <code>secret</code> key protected, or if I should generate random IDs and link them to the token internally.</p>