title: Advantages of using OAuth Password Credentials Grant over Token Access Authentication
body: <p>I am creating an API for a mobile application using Rails 5. At the moment, I don't need three-legged authorization, as the API will only be consumed by our own mobile apps.</p>
  <p>I'm thinking of choosing one of these two options:</p>
  <ol>
  <li><strong>Doorkeeper + Devise:</strong> I can implement OAuth 2.0 using Doorkeeper, but I will only be using the Password Credentials Grant, at least for now.</li>
  <li><strong>Rails' own <code>ActionController::HttpAuthentication::Token</code> module + Devise</strong>: This seems like the simpler way to go.</li>
  </ol>
  <p>Honestly, I can't see the difference between the <a href="https://datatracker.ietf.org/doc/html/draft-hammer-http-token-auth-01" rel="nofollow noreferrer">Token Access Authentication</a> method and <a href="http://oauthlib.readthedocs.io/en/latest/oauth2/grants/password.html" rel="nofollow noreferrer">OAuth 2.0's Password Credentials Grant</a>.</p>
  <p>How would one choose one over the other? Is there any other option that needs to be considered?</p>