title: Looking for advice to secure a private REST API written in python-flask
body: <p>I am currently writing a rest API in python with the microframework Flask. <strong>It's a private API and it deals with user data</strong>. I plan to use this API to build a web and an Android app.</p>
  
  <p>For now I use digest auth to secure private user data. For example if you want to post data on my service with the user bob you make a post request at myapi/story/create and provide bob's credentials with the digest pattern.</p>
  
  <p>I am aware this is not a good solution because :<br>
  -Digest auth is not secure<br>
  -The client is not authenticated (How to secure requests not related with current user, for example create a new user ?)</p>
  
  <p>I read a lot of stuff about oAuth but the 3-legged authentication seems overkill because I don't plan to open my API to third party.<br>
  The 2-legged oAuth won't fit because it only provides authentification for clients and not for users.<br>
  Another problem with oAuth is that I haven't found a comprehensive guide for implementing it in Python. I found the <a href="https://github.com/simplegeo/python-oauth2">python-oauth2</a> library, but I don't understand the server example and I can't find additional documentation. Plus it seems that many aspects of oAuth are not covered in this example.</p>
  
  <p>So my questions are :</p>
  
  <ol>
  <li>Is there alternative scheme (not oAuth) for authenticate both client and user with a reasonable level of security ? </li>
  <li>If oAuth is the best solution :
  <ul>
  <li>How to skip the authorization process (because users won't have to authorize third party clients)?</li>
  <li>Is there detailled documentation for python-oauth2 or for any other Python library?   </li>
  </ul></li>
  </ol>
  
  <p>Any help or advice will be appreciated. </p>