On: Designing a Pragmatic RESTful API

[gizzlon]

What are the benefits of doing this instead of just requiring authentication with every request?

Is it because the authentication part is a lot of work for the server or client?

Is it for the negligible (in this context) security benefits of not using the same secret-key for all traffic?

[general_failure → gizzlon]

The hashing for the authentication is intentionally computationally slow (thus mitigating brute force validation). The token issued is basically like a session id - validating a session id is really just like string compare, so it's much much fast.