title: Authentication strategy for REST API and mobile app
body: <p>I'm creating a REST API server with Node.js and Express + MongoDB.
  This API will have different mobile clients (iOS, Android) and possibly a web app later on.
  I need users to login in order to perform some API requests. There are no 3rd party apps I want to connect with (no Facebook, Google etc). I also don't want to force the users to visit a webpage or anything like that in order for them to login.</p>
  
  <p>From what I've seen on my many searches on SO, the best approach would be to let users login with full credentials once, send them a token in return, and use that token to verify future requests until it expires.</p>
  
  <p>However, I'm not sure how to implement this. 
  I'm very confused with all of the different strategies. Is this done with basic authentication over HTTPS, with OAuth, OAuth 2.0, ... ? I just don't know what to use.
  Also, I really don't want to reinvent the wheel here, not because I'm lazy, but mainly because of security concerns. Is there a library I could use to implement this? I've heard of Passport, but I couldn't understand if this is doable or not. This sounds like such a generic thing I'm sure there's a simple solution out there.</p>
  
  <p>Thanks!</p>