Short answer: Yes, you can use cookies, but not all systems support that (eg mobile apps). Here's what I do for that case: Create a /sessions endpoint and POST

Short answer: Yes, you can use cookies, but not all systems support that (eg mobile apps). Here's what I do for that case: Create a /sessions endpoint and POST to that when you login. The session resource will include a token of some sort identifying the session securely. The client can then authenticate to the API by passing this token via an HTTP header.