title: How does a REST API know if a user is logged in?
body: <p>I am creating an 'API as a service' by developing a separate REST API server and a web-app server which simply serves up a website that consumes the REST API. The web-app acts as a client of the API. The web-app is a simple dashboard that allows a user to login and see their API usage and view their API secret and keys so that they can access the API securely. </p>
  
  <p>I am planning on using AWS-like shared secret to enable clients of the API to access protected resources.</p>
  
  <p>But one thing im confused about is when the user logs in to the dashboard website, should this be handled by the REST API, or by the web-app server.</p>
  
  <p>If it is to be handled by a REST API endpoint, how does the API server maintain session state between requests. How does the API know if the user is logged in or not? Is it ok to store session state on the API server, even though it is supposed to be stateless. How do other rest-like API's like twitter do this?</p>