I set Secure API to site where client fills some data to form and this data in JSON format pushes to Salesforce. All values of grant_id, cliend_id, client_secret, username, password+security token in Postman were added, as a result - access_token was being got and was being pushed into Bearer token. All requests was tested - it worked great! But what if security token of Salesforce user will be reset? Do I need to set insecure API? And main question - how can I catch that? Thanks a lot for help!
Your integrations should not store a user's raw credentials (username, password, security token). When you do so, your integration is vulnerable to password resets, and more importantly, you risk exposing user credentials.
Instead, your integration should implement OAuth using a flow that grants a refresh token or permits headless authentication, such as the Web Server flow or JWT flow. Such integrations are durable across password and security-token resets.