REST service authentication : where to store user credentials?

Question

I am developing an ASP.NET MVC web application. The application is consuming a REST API, but authentication for REST-full application is quite unclear for me.

As REST is stateless, do I have to implement two different Authentications with two different databases, one for client, and one for the REST service?

Or, do I have to send the login/password each time, to authenticate on the server?

Please give me some advice or tutorial on this.

Answer 1

You can authenticate a Web API using individual user accounts that are stored in a database. In this case client should obtain access token first. And then include it to each request, that requires authorization, header:

Authorization: Bearer boQtj0SCGz2GFGz[...]

Good tutorial can be found HERE

Also authentication methods could be extended in Startup.Auth.cs with Cookies or some external authentication methods (Google, Facebook etc)