While this is the easiest method to get an access token, it is also the least secure. Passing your credentials as query string parameters in a URL is generally frowned upon by security experts. Since HTTPS is required to request a token your credentials and all other query string parameters are encrypted during transit, but might show up as clear text in web server logs or other places.