I'm trying to work out the best way to handle user authentication for my mobile application (iOS & Android) and API (PHP).
From what I've researched the options are:
Basic auth over HTTPS - Check username/password of the user for every request.
Sessions - Send a session ID with each request; server maintains state. So app sends username/password and server checks for a logged in user on subsequent requests, just like my website does.
API tokens - Mobile app sends username/password and receives a token back, then appends this to subsequent requests. Token stored in DB and checked on each request.
I'm guessing my explanation of API tokens is incorrect as they seem identical to sessions because I store session ID's in the DB.
- Could my explanation of API tokens be corrected. What are they for? How do they differ to session ID's?
- What are the advantages of API tokens?
- Is oAuth (if we were to simplify its uses) just a protocol for creating "API tokens"?