title: What is the most common way to authenticate a modern web app?
body: <p>I'm writing a web app (REST API) using Spring, Spring Security. Right now I have Basic authentication and a really straightforward authorization using username, password and roles. I want to improve the security layer but I have no experience with this.</p>
  <p>When I had looked at postman for possible authentication methods and searched on google I've seen there are these options:</p>
  <ul>
  <li>API key</li>
  <li>Bearer Token</li>
  <li>Basic Auth</li>
  <li>Digest Auth</li>
  <li>OAuth 1.0</li>
  <li>OAuth 2.0</li>
  <li>Hawk Auth</li>
  <li>AWS Signature</li>
  <li>NTLM Auth</li>
  </ul>
  <p>Digest, Hawk, AWS and NTLM seem to be really specific cases so I omit them.</p>
  <p>I've heard just some general information about API key, Bearer Token and OAuth 1.0\2.0, but OAuth 1.0 seems to be outdated or something (I mean, there is a reason for version 2.0 to exist).</p>
  <p>So as a result it seems that I have 3 possible variants:</p>
  <ul>
  <li>API Key</li>
  <li>Bearer Token</li>
  <li>OAuth 2.0</li>
  </ul>
  <p>Is my assumption correct? What is the most widely-used case in modern web apps for security layer?</p>
  <p>I don't ask for a full description for each case, just general recommendations, maybe some links\resources to look at.</p>
  <p>What should I concentrate on?</p>
  <p>What mistakes in my description\explanation do you see?</p>