Which REST API authentication method combines the use of passwords and tokens?
OAuth (specifically OAuth 2.0) is the REST API authentication scheme that blends credential-based and token-based authentication: a client first authenticates using credentials (such as a username and password, as in the Resource Owner Password Credentials grant, or client ID/secret) against an authorization server, which then issues an access token. That token—not the original password—is subsequently used to authenticate and authorize requests to the API. This two-step approach differentiates OAuth from basic authentication (which resends the password with every request), API keys (a single static key with no password step), and bearer/token authentication (which uses only a pre-issued token without a password exchange as part of the same mechanism).
Community Discussion