title: REST API Authorization & Authentication (web + mobile)
body: <p>I've read about oAuth, Amazon REST API, HTTP Basic/Digest and so on but can't get it all into "single piece". This is probably the closest situation - <a href="https://stackoverflow.com/questions/3963877/creating-an-api-for-mobile-applications-authentication-and-authorization">Creating an API for mobile applications - Authentication and Authorization</a></p>
  
  <p>I would like to built API-centric website - service. So (in the beginning) I would have an API in center and <strong>website</strong> (PHP + MySQL) would connect via <strong>cURL</strong>, <strong>Android</strong> and <strong>iPhone</strong> via their network interfaces. So 3 main clients - 3 API keys. And any other developer could also develop via API interface and they would get their own API key. API actions would be accepted/rejected based on userLevel status, if I'm an admin I can delete anything etc., all other can manipulate only their local (account) data.</p>
  
  <p>First, authorization - should I use oAuth + xAuth or my some-kind-of-my-own implemenation (see <a href="http://docs.amazonwebservices.com/AmazonCloudFront/latest/DeveloperGuide/RESTAuthentication.html?r=9197" rel="noreferrer">http://docs.amazonwebservices.com/AmazonCloudFront/latest/DeveloperGuide/RESTAuthentication.html?r=9197</a>)? As I understand, on <strong>Amazon service user is == API user (have API key)</strong>. On my service I need to separate standard users/account (the one who registered on the website) and Developer Accounts (who should have their API key).</p>
  
  <p>So I would firstly need to <strong>authorize the API key</strong> and then <strong>Authenticate the user</strong> itself. If I use Amazon's scheme to check developer's API keys (authorize their app), which sheme should I use for user authentication?</p>
  
  <p>I read about getting a token via <code>api.example.org/auth</code> after (via <strong>HTTPS</strong>, HTTP Basic) posting my username and password and then forward it on every following request. How manage tokens if I'm logged in simultaneously on <strong>Android</strong> and a <strong>website</strong>? What about man-in-the-middle-attack if I'm using SSL only on first request (when username and password are transmitted) and just HTTP on every other? Isn't that a problem in this  example <a href="https://stackoverflow.com/questions/8562223/password-protecting-a-rest-service">Password protecting a REST service?</a></p>