I am trying to create a Rest Api using a token based Authentication.

Is there any best practice in passing credentials from client to server for generating the token. As a **HTTP Header or as a JSON String in post body**?

I have been searching around but was not able to find any concrete answers.