I'm writing an iOS app that displays content from a website managed by Drupal. I figured how I can create views in Drupal for delivering the content as JSON to the app. But now I want to enable my logged-in users to flag content as their favorites. Users can create an account on the website and are also able to log in inside the app. Favorites are stored per user.

In Drupal this is implemented using the [Flag module](https://drupal.org/project/flag), which renders corresponding links for toggling the flags on the website. Those links point to a specific URL that also contains a token to prevent spoofing. Calling the URL without the token leads to access denial.

Now unfortunately I can't generate those tokens in my app. Is there a way to flag content without using the website?

I'm new to Drupal. All I need is basically a hint on how to implement my own HTTP APIs that allow external programs to manipulate content.