title: RESTful API, where to place the Authorization key
body: <p>I'm building an api, on Laravel framework, meant for portable devices. I have read plenty of articles on how to properly secure the data and the transfers.</p>
  
  <p>These are the action that I am taking to secure:</p>
  
  <ol>
  <li>Send the data to an <code>https</code> domain with <code>TLS</code></li>
  <li>Unique API key for each device</li>
  <li>Unique Tooken that are being regenerated from time to time.</li>
  <li>The tooken is used to encrypt the data, using <code>hmac-sha1</code></li>
  </ol>
  
  <p>So I got left 2 questions:</p>
  
  <ul>
  <li>Should I send the API key set in a header like <code>X-Authorization</code>? Or add it to all my POST/GET/PUT/DELETEs within the encrypted data with <code>hmac-sha1</code>?</li>
  <li>Any big difference between the 2 methods pointed above?</li>
  </ul>
  
  <p>I mostly based on this tutorial: <a href="http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/" rel="nofollow">http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/</a> And other question related to the issue on SO</p>
  
  <p>P.S. If there is anything that you think I could improve, please let me know!</p>