title: How do people handle authentication for RESTful api's (technology agnostic)
body: <p>i'm looking at building some mobile applications. Therefore, these apps will 'talk' to my server via JSON and via REST (eg. put, post, etc).</p>
  
  <p>If I want to make sure a client phone app is trying to do something that requires some 'permission', how to people handle this?</p>
  
  <p>For example:</p>
  
  <blockquote>
    <p>Our website sells things -> tv's, car's, dresses, etc. The api will
    allow people to browse the shop and purchase items. To buy, you need
    to be 'logged in'. I need to make sure that the person who is using
    their mobile phone, is really them.</p>
  </blockquote>
  
  <p>How can this be done?</p>
  
  <p>I've had a look at how twitter does it with their OAuth .. and it looks like they have a number of values in a REQUEST HEADER? If so (and I sorta like this approach), is it possible that I can use another 3rd party as the website to store the username / password (eg. twitter or Facebook are the OAuth providers) .. and all I do is somehow retrieve the custom header data .. and make sure it exists in my db .. else .. get them to authenticate with their OAuth provider? </p>
  
  <p>Or is there another way? </p>
  
  <p>PS. I really don't like the idea of having an API key - I feel that it can be too easily handed to another person, to use (which we can't take the risk).</p>