title: Switching from Basic Authentication to OAuth 2.0 for Django & Tastypie
body: <p>I'm a self taught back end engineer so I'm learning all of this stuff as I go along. For the longest time, I've been using basic authentication for my users. As long as you have the right username and password, you can access all the Tastypie API resources. </p>
  
  <p>Many developers are advising against this approach since each request will contain the username &amp; password. Anyone with the right skills can listen in on the connection between my iOS application and my Django Server and obtain their password.</p>
  
  <p>I wouldn't want to put my user's credentials at risk so I would like to implement a more secure way of authentication. I've been doing a lot of reading and came across OAuth 2.0 which  has the whole token approach. The only time when the username and the password is sent to the server is when they are requesting an access token. </p>
  
  <p>After the access token is given (each user will have a unique access token), that token is used to authenticate instead of the username and password. </p>
  
  <p>This way, anyone listening in will only see the token. If the token is exposed, I can easily remove the old token and generate a new token for the user.</p>
  
  <p>Along side this, I would like to make it so that only requests coming from my iOS application are able to access the tastypie resources.(I'm thinking of generating a application key for my app and if third party services want to use the service, I will grant them a unique key as well)</p>
  
  <p>How can go about implementing this into my Django setup? Can I use OAuth2.0 do to this? If I implement this setup, how can I make it so that attackers are unable to obtain the application token?</p>