is that possible only user parameter access_token to replace header about oauth1

[kosso]

No. Not for OAuth1.0. All requests need to be 'signed'.

To do the style of authentication you are suggesting needs OAuth2.0, where the access_token can be passed like your example, as a query parameter, or as a single request header using Authorization: Bearer 1234youraccesstoken - BUT, this should really only be used if your server is running securely through SSL as https://www.example.com/wp-json/users?access_token=W2NILogo2yynwwlzTIlDAb1Q

Many people do not have the ability to run their server over SSL / https, so this is why we have the OAuth1.0a version.

This was discussed in a previous issue : #2 (comment)

[wesleyxiao]

Thanks kosso