>>And while you're at it, don't use HTTP authentication either. Use signed queries that authentication each API call individually. Beyond server-server api cal

>>And while you're at it, don't use HTTP authentication either. Use signed queries that authentication each API call individually. Beyond server-server api calls and authentication, I'm curious to know what folks think about authentication and individual-user client apps making api calls to a server. If you build a web service whose REST apis are only intended to be consumed by customers of your $0.99 mobile app, one option is to use no authentication at all. This means that a third-party may potentially write another $0.99 app that "steals" your web-server resources. Has this been a problem and what (if any) schemes (e.g. digest auth, facebook login etc.) have you used to mitigate the problem. (facebook login etc. doesn't fully address the problem unless you can distinguish between facebook users who have purchased the app and facebook users who haven't purchased the app )