title: Should Web API server use session id and/or auth-token?
body: <p>According to @Veraticus's answer on this <a href="https://stackoverflow.com/questions/13197863/web-application-without-sql-query-for-current-user-authentication">question</a>, Web authentication framework are saving the ID of the current_user in a <em>session id</em> in order to quickly and easily retrieve the user from the database (without fetching the user each time with a new query on the database).</p>
  
  <p>This is great because it's exactly what I want to do with my own server (for performance reasons), through its API which I'm writing.</p>
  
  <p>But I wondering about <em>session id</em>... I mean, if the server handle sessions, the client have to provide to him a <em>session id</em>.</p>
  
  <p>However, I'm also wondering about another thing: in general, Web API are using an <em>API key</em> (for instance, <a href="https://api-docs.heroku.com/" rel="nofollow noreferrer">https://api-docs.heroku.com/</a>). And using an <em>API key</em> and a <em>session id</em> may be complicated for the client...</p>
  
  <p>I hope Heroku don't perfom a database query with the received auth-token at each HTTP request. But if they don't, how could they do to authenticate a user without its <em>session id</em>?</p>
  
  <p>I'm confused. Thank you a lot for any ideas.</p>