title: API Authentication method for a social network's own mobile app
body: <p>As we all know social networks like Twitter, Facebook have their own mobile apps. Other 3rd party apps use their API which can be authenticated over only OAuth protocol after registering for an app.</p>
  
  <p>So how exactly do Facebook, Twitter, Foursquare etc. access their API on their own mobile apps via authenticating by "username" and "password"? I don't think that they just send username and password as parameter on each request.</p>
  
  <p>One more important point is, when you log in those official mobile apps, you don't come across a web interface, asking for permission and has button "Allow this app" which exists in OAuth process. They're authenticated by default!</p>
  
  <p>While investigating I came across <strong><a href="http://xauth.org" rel="nofollow">XAuth</a></strong>, however after watching its introductory video, it seemed like a shared storage on browser. I'm not looking for that and then I came across use of <strong><a href="https://dev.twitter.com/docs/oauth/xauth" rel="nofollow">xAuth in Twitter</a></strong>. It  authenticates by sending username/password once over SSL and then server issues an OAuth token/secret pair. (This looks like OAuth v1 instead of v2, which is not cool.)</p>
  
  <p>It looks like what I'm looking for but I'm not quite sure. Are there any alternatives other than maintaining an OAuth server that xAuth requires? Because in my use case, probably 3rd party apps will not exist at all. </p>