Authentication on a simple PHP RESTful API service
<p>I have a developed a very simple PHP API based on the PHP Slim Framework. It does nothing more then doing some SQL queries and returning an JSON object whenever I call it. I am accessing this API on another website through CURL. </p>

<p>My question is: Since the URL of the API is basically public now, what is the best way of securing it? My first thought was HTTP Basic Auth which would be easy and I could pass through the http headers. However I think it's not really safe as long as there is no HTTPS connection (since the website would literally pass username+password over to the API in plain text). Also I would have to store the credentials in PHP code on my website, which I think is not really optimal.</p>

<p>The next solution I've found is token based authentication, which would have the advantage of not having to authorize on each request but might be more tricky to implement. Also I have no experience with that yet whatsoever.</p>

<p>Also I read OAuth/OAuth2 is the way to go.</p>

<p>The thing is: I am planning to use the same API on a mobile application soon.</p>

<p>Any hints? Thanks!</p>