If you&#x27;re using an authentication token, it&#x27;s not really REST. Because of the dire situation wrt. client certificates, the only straight-forward, &quot;pure&quot; REST, would be to supply Basic Auth on every request (that doesn&#x27;t allow anonymous access).<p>I&#x27;m not really convinced that&#x27;s <i>not</i> a good idea for a TLS-only service (compared to the complexities that tokens&#x2F;cookies introduce). One reason why there was a move away from Basic Auth was ofcourse that it is crazy to send plain-text login&#x2F;password pairs over a plain-text transport (HTTP sans S).<p>And there&#x27;s never been any working, cross-platform effort to improve things (AFAIK).<p>There&#x27;s some work on Kerberos that&#x27;s interesting, but again, many of these efforts have been simply co-opted by the fact that everyone used cookies (and had problems, and started encrypting them etc), and <i>then</i> moved from HTTP to HTTPS.<p>When you have HTTPS, there&#x27;s not that many reasons to not just have &quot;SECRET PASSWORD&quot; in the URL (granted that&#x27;d not be REST either, but BASIC AUTH does the same thing, just in a header).