Right, I get that. I just think, or would hope, rather, that access tokens are locked down appropriately or never "over-granted" access to unnecessary data. In

Right, I get that. I just think, or would hope, rather, that access tokens are locked down appropriately or never "over-granted" access to unnecessary data. In this case, my phone number which isn't on my profile. If that means different API tokens for different services, then maybe that's a better way to do it. I'm not Facebook, though.