Take the 2-minute tour ×  We're implementing a web application
(US) that needs to exchange sensitive information with a third-
party web application (THEM). The way we'd like it to work is
that an end user clicks a hyperlink, navigates to the third-
party web application and magically the sensitive information is
available to the third-party web application.  As you'd expect,
we'd rather not send that sensitive information along with the
url the user clicked. We do not control the third-party web
application, but we can impose how they integrate with our web
application. We'd like to keep this as simple as possible from a
technology perspective (low bar to entry so to speak). Obviously
we have full control over our own web application.  We were
thinking along the lines of having some sort of one-time usable,
randomly generated, restricted in time, access token.    1. We
assume the end-user has been identified/authenticated.   2. The
end-user clicks a link which obtains an access token from our
own web applicati