title: What is an API token
body: <p>I'm trying to work out the best way to handle user authentication for my mobile application (iOS &amp; Android) and API (PHP).</p>
  
  <p>From what I've researched the options are:</p>
  
  <p><strong>Basic auth over HTTPS</strong> - Check username/password of the user for every request.</p>
  
  <p><strong>Sessions</strong> - Send a session ID with each request; server maintains state. So app sends username/password and server checks for a logged in user on subsequent requests, just like my website does.</p>
  
  <p><strong>API tokens</strong> - Mobile app sends username/password and receives a token back, then appends this to subsequent requests. Token stored in DB and checked on each request.</p>
  
  <p>I'm guessing my explanation of API tokens is incorrect as they seem identical to sessions because I store session ID's in the DB.</p>
  
  <ol>
  <li>Could my explanation of API tokens be corrected. What are they for? How do they differ to session ID's?</li>
  <li>What are the advantages of API tokens?</li>
  <li>Is oAuth (if we were to simplify its uses) just a protocol for creating "API tokens"?</li>
  </ol>