Limited-use access tokens protect against request spoofing and
[replay attacks](https://en.wikipedia.org/wiki/Replay_attack), ensuring that the
action is performed by the intended recipient. You protect against these
attacks by adding a unique token parameter to the request parameters and
verifying it when the action is invoked.

Generate the token parameter as a key that can only be used for a specific
action and a specific user. Before performing the requested action, verify that
the token is valid and matches the one generated for the user. If the token
matches, perform the action and invalidate the token for future requests.

Send access tokens to the user as part of the `url` property of the
[HttpActionHandler](https://developers.google.com/workspace/gmail/markup/reference/types/HttpActionHandler).
For example, if your application handles approval requests at
`http://www.example.com/approve?requestId=123`, consider adding an
`accessToken` parameter and handling requests sent to
`http://www.example.com/approve?requestId=123&accessToken=xyz`.

The combination `requestId=123` and `accessToken=xyz` must be generated in
advance; ensure that the `accessToken` cannot be deduced from the `requestId`.
Reject any approval request with `requestId=123` and no `accessToken` or with an
`accessToken` not equal to `xyz`. After this request succeeds, reject any future
request with the same ID and access token.