A method and apparatus for protecting user information. The method includes receiving a request for accessing the user information from an application. When the request does not include an authorized token, the user is requested to temporally confirm the request for access. In response to the confirmation, a token is generated and the user on a mobile service platform is associated with the request for access by the token. The application is then allowed to access the user information based on the token associating the user with the request for accessing the user information from the application.