[AlexWhite_]

This solution is insecure. Any person can intercept token and make harm to your application.

[xmrcivicboix]

I completely agree. Hence I said it's temporary. When you have a huge influx of paying customers who cannot log in to do their work, you have to balance that a bit.

[svens_]

It doesn't seem too bad when enforcing https (using the return address whitelisting in the developer console). Am I missing something?

[AlexWhite_]

Customer will see token anyway