title: Securing REST API on Play framework and OAuth2
body: <p>I am developing an application with <strong>Play 2.0</strong> and <strong>Scala</strong> that exposes some REST API. These APIs will be used by different applications, web, mobile or desktop, so the OAuth protocol (OAuth2) seems the most suitable.</p>
  
  <p>Also I would initially use an external OAuth Provider such as Facebook.</p>
  
  <p>My question is: what is the exact flow to authorize the individual REST call? What should I expect on the server side for each call and what I should check with the external provider? </p>
  
  <p>With OAuth1 I knew that the client sent the token with all the signed request, but with Oauth2 I think not so, I imagine that if a token is not signed is not trusted and therefore I do not think this is the flow.</p>