Can OAuth access tokens be used as a public ID?
===

My application is essentially a stateless proxy that converts some data fetched from a service into a different format and serves it to the user on-the-fly. Since the data is not confidential, the only method of authentication will be a large, random URL. Nevertheless, the OAuth access token I'll need to store in order to fetch the data does provide some `write` features, which I'd like to avoid leaking.

My question is whether is it safe to use the access token as a public identifier on the URL and just keep the `secret` key protected, or if I should generate random IDs and link them to the token internally.