title: Authenticating HTTP requests to my web service
body: <p>my situation is that I am writing a web service to expose data to an Android/iOs app that I plan to create.</p>
  
  <p>I have never dealt with authentication for a REST API before so I was wondering if my idea of authentication is correct?</p>
  
  <p>Would this be a correct process:</p>
  
  <ol>
  <li><p>Client is authenticated with Facebook login and we generate a token for this client, stored in the db. This token will expire after some time. (what happens when it expires? do we generate another token during the next http request or just log the person out?)</p></li>
  <li><p>Client makes http request, passing in the token in the query string</p></li>
  <li><p>Check db if token is correct for this user</p></li>
  <li><p>Give client access to the data or access to manipulation of the data</p></li>
  </ol>
  
  <p>Thanks in advance for verifying my thoughts</p>