Is OAuth irrelevant when HTTPS is used?

Question

I am designing a RESTful API which will always communicate over HTTPS. Is there any reason to use a scheme like OAuth when running over HTTPS? I am particularly interested whether or not aspects like HMAC-signed requests, nonces, and timestamps are useful when the entire communication is encrypted.

It seems like any authentication scheme over HTTPS is sufficient but I just wanted to get a second opinion.

Answer 1

Well, that's the whole theory behind OAuth 2. Instead of the complicated signature mechanisms of OAuth 1, you just rely on transport-layer security and focus on the authorization piece of the puzzle. The HTTPS protocol does not solve the authorization piece, so you still need OAuth 2 for that.