title: What's the best way to handle API authentication for users (especially for mobile devices)
body: <p>We're looking to create an API for our website. One of the major usages for the API (I suspect) will be to allow people to create mobile apps (for the iPhone and hopefully other devices).</p>
  
  <p>What's the best way to handle API authentication for users. As a general rule, I don't like encouraging our users to hand their username/email/password details over to a 3rd party. However, is using oAuth acceptable/mature enough to work with for mobile devices? The only people using oAuth for mobile apps appear to have been Pownce, which seems to have had user issues and in any case is no longer around for me to see how they have dealt with the problem. </p>
  
  <p>(Our user base is very untechnical, so I would expect &lt;1% to have ever dealt with oAuth before)</p>
  
  <p>The choice seems to be:</p>
  
  <ol>
  <li>Ignore the issue with 3rd parties and passwords</li>
  <li>Force developers to implement oAuth integration</li>
  <li>Try something user unfriendly (such as using a secret key rather than their password)</li>
  </ol>
  
  <p>Am I missing something?</p>