title: Secure API Authentication method
body: <p>We are working on a new project, we are two lead developers and got on a cross road on how to use a token to secure the communication between the server and the client :</p>
  
  <h1>First Suggestion :</h1>
  
  <p>Step one) the client requests a primary token, by sending the username and password and the current_time (this variable will be saved in the server's database and the client side too) to the api, the server interprets the input, and renders a hashed token (e.g. : 58f52c075aca5d3e07869598c4d66648) saves it in the database and returns it to the client.</p>
  
  <p>Step Two) The client now saves the primary token, and creates new hashed token using the primary token + the current_time variable sent in the authentication request (lets call this new token, main_token) also the server does the same and create the same token using the same algorithm.</p>
  
  <p>Step Three) Each time the client queries the server API, it sends the main_token to the server, now the server compares the token generated in it, with the main_token sent by the client, if it matches, it means the user is real</p>
  
  <h1>Second Suggestion :</h1>
  
  <p>Step One) The client generates two random keys ($key1 = rand(10000,90000);
  $key2 = rand(10000,90000);) On each request on the API, the client creates a hash using the query type, and the two keys with a complex algorithm, and sends these two keys + the hash to the server</p>
  
  <p>Step Two) The server, using the same Algorithm used in the client, creates a hash, and compares is to the one sent by the client, if it matches, the server proceeds to deal with the query</p>
  
  <hr>
  
  <p>Now, the question is, Which one is the most logical, and secure way to use for securing the api requests</p>
  
  <p>Best Regards</p>