After having developed my first web portal (using railstutorial.org), I'm now making my way in building my first API (with some help).

Authentication for the web portal works with `session` as well as with a cookie (if the user wants his log in to be remembered).

For the API I understand that using `session` is insecure; you need to work only with a token. So, just as for the web portal, when a user logs into the API his credentials get checked, and if they are valid a token is generated of which the digest is stored to the database.

But then: I understand there are then three options what to do with the token: to store the token on the user's computer using a *cookie*, include the token as *parameter* or use the *HTTP header*. I read for APIs using the HTTP header is the preferred option.

* If using the **cookie**, it is the same as the 'remember me' option for the web portal: the token is stored in the cookie and a digest of the token is stored in the database. With each API request the cookie is read and it is checked if it's token matches the digest.
* Each time the API sends data to the user or the user makes a call to the API, the token is included as a **parameter**. I understand that this displays the token in the URL, which is not desirable.
* My understanding of using the **HTTP header** fails.

**What does it mean to use the HTTP header to send the token, instead of a cookie? What is the process/logic behind it? When to use a cookie, a parameter or the HTTP header?**  

Am I correct in my understanding that each time the API sends data to the user, it should include the token in the HTTP header? And each call the user makes to the API should include that same token?