I wrote a blog post about securing complex API ecosystems. Read about token sharing, embedding, and exchanging here: https://curity.io/blog/3-solutions-for-securing-complex-api-ecosystems/