title: While creating REST API, How authentication token should be used
body: <p>While creating REST API, what is the best practice to use authentication token.
  API should except the authentication token in url itself or in HTTP-HEADER.
  What is the best place for the authentication token and why?</p>