Generating cryptographically secure authentication tokens

Question

Background:

This is really a general best-practices question, but some background about the specific situation might be helpful:

We are deve

Answer 1

You should implement:

1. OAuth2 Implicit Grant - for third-party applications http://tools.ietf.org/html/rfc6749#section-1.3.2
2. OAuth2 Resource Owner Password Credentials — for your own mobile application http://tools.ietf.org/html/rfc6749#section-1.3.3

which are exactly the workflows, from OAuth2, that you are looking for. Do not reinvent the wheel.