What is the best way to get passwords for basic auth in a API and why?

Question

Creating a API here and I want people to be able to make simple mobile apps that could get the username/password of my users and of they go to interact with my server. So I need to have a Basic Auth(OAuth and other stuff are also going to be supported, mostly for a different use case). Right now I have a example from a Book saying i could just receive the (unencrypted) password as part of the post and looking at successful APIs I see that twitters gets unencrypted passwords on the headers of their HTTP request.

Another options would be to get md5 or SHA1 hashes, but without a secret salt, this seems like an exercise in futility. I asked a couple of people and everyone had a different(strong and heuristic) point of view, so....

What is the best way to get passwords for basic auth in a API and why?

Answer 1

Uh, do not give out the passwords of your users to other apps. Or via your API. Or ever. They should be stored 1-way anyway (i.e. hashed).

But I'm not so sure if that is what you are saying. You talk about OAuth (which you can use to generate tokens that let API's access various components of your system, because the user says that it is possible).

For example, say you wish to allow API-users to query a certain users properties (say, their location), then you create a token for this access via OAuth, and the API-caller passes that. At least, this is my understanding of the model. Obviously, you should review OAuths webside, and find an appropriate implementation for your given language.