security - API Keys vs HTTP Authentication vs OAuth in a RESTful API -

i'm working on building restful api 1 of applications maintain. we're looking build various things require more controlled access , security. while researching how go securing api, found few different opinions on form use. i've seen resources http-auth way go, while others prefer api keys, , others (including questions found here on so) swear oauth.

then, of course, ones prefer, say, api keys, oauth designed applications getting access on behalf of user (as understand it, such signing non-facebook site using facebook account), , not user directly accessing resources on site they've signed (such official twitter client accessing twitter servers). however, recommendations oauth seem basic of authentication needs.

my question, then, - assuming it's done on https, of practical differences between three? when should 1 considered on others?

it depends on needs. need:

• identity – claims making api request?
• authentication – are?
• authorization – allowed trying do?

or three?

if need identify caller keep track of volume or number of api calls, use simple api key. bear in mind if user have issued api key shares else, able call api well.

but, if need authorization well, need provide access resources based on caller of api, use oauth.

here's description: http://www.srimax.com/index.php/do-you-need-api-keys-api-identity-vs-authorization/