According to the stateless constraint of REST, you cannot maintain sessions on server side. You have to authenticate every request instead.
There are 2 kind of clients:
- trusted clients developed by you (the web service developer)
- 3rd party clients developed by anybody else
By a trusted client the simplest solution to send the username and password with every single request. For example by basic HTTP auth in a HTTP header. (Ofc. with encrypted connection.)
Since your user cannot trust 3rd party clients with her password, you have to find out something else by there. A typical solution (e.g. facebook) to add a unique API key to each of the 3rd party clients. After that when the user wants to use one of them, she gets a prompt. Using that prompt she can grant access to the 3rd party client to use some part of her account. During this process the accessToken, userId, apiKey, permissions
are saved on the server and the 3rd party client gets an access token for the user. After that the 3rd party client can use the access token (along with the API key and user id) to use the web service utilizing the account of the user.