title: Token Authentication for RESTful API: should the token be periodically changed?
body: <p>I'm building a RESTful API with Django and <a href="http://www.django-rest-framework.org/" rel="noreferrer">django-rest-framework</a>.</p>
  
  <p>As authentication mechanism we have chosen "Token Authentication" and I have already implemented it following Django-REST-Framework's documentation, the question is, should the application renew / change the Token periodically and if yes how? Should it be the mobile app that requires the token to be renewed or the web-app should do it autonomously?</p>
  
  <p>What is the best practice?</p>
  
  <p>Anybody here experienced with Django REST Framework and could suggest a technical solution?</p>
  
  <p>(the last question has lower priority)</p>