Ordered access to resources is controlled by restricting access to additional resources that are accessible when a client device provides an authentication provided when accessing an initial resource. When the client device accesses the initial resources, a set of access parameters are identified describing the request and the client device providing the request, and included with an expiration time in generating a token. The token and expiration date are provided in an authorization for the additional resources. When requesting the additional resources, the authorization is provided and verified by comparing the token in the authorization with a test token generated with reference to access parameters of the request for additional resources. When the tokens match, the additional resource is provided to the client device.