title: Is it OK to pass on OAuth Access Token between services?
body: <p>Considering the following scenario in a context of the SSO/OAuth/microservices:</p>
  
  <ol>
  <li>User successfully logs-in to the web application using OAuth's Implicit Flow.</li>
  <li>Web app requests some data from <strong>Service A</strong> and <strong>Service B</strong> passing on user's Access Token to authorize both requests.</li>
  <li><strong>Service A</strong> also calls <strong>Service B</strong> (passing on the same Access Token!) in order to build response to the initial Web App request.</li>
  </ol>
  
  <p>Now, is this OK to pass on the user's Access Token from <strong>Service A</strong> to <strong>Service B</strong>? </p>
  
  <p>Or should <strong>Service A</strong> use "Client Credentials" grant to obtain its own Access Token to authorize call to the <strong>Service B</strong>?</p>
  
  <p><strong>UPDATE</strong>:<br>
  Please assume both services are owned by the same organization and both trust the same Authorization Server. Also both services are behind the same API Gateway which validates Access Tokens.</p>