There are three authentication mechanisms for access the Whisk Graph API. They all require registering an application on Whisk Platform first. You can do this by sending email to [email protected]
A server token can be used to access data that does not require a Whisk user context.
Issued Server Token plays role of ApiKey and need to be stored securely. It should be used only from servers (not browsers or devices)
Server Token allows you to use range of Whisk APIs in read-only manner (e.g. Feed, Search). In addition to that it will allow to use APIs to manage Application configuration.
A user access token is required when an Whisk user context is necessary, and is generated using the OAuth 2.0 flow. It allows you to access following APIs:
The client token is an identifier that you can embed into native mobile binaries or desktop apps to identify your app. The client token isn't meant to be a secret identifier because it's embedded in apps. The client token is used to access limited subset of Whisk APIs.