Authentication for REST API like done in amazon, facebook, dropbox they most probably conform to HMAC pattern. See here, here, here, and here.
there is oauth which redirects end user to another site to verify their password
if you would like to have user name passwords, check this out on how to transmit. e.g. do oauth send token to use it later on. See here and here.
Incorporating Hmac See here, here, and here.