I think the best approach is to use OAuth2. Google it and uyou will find a lot of useful posts to help uyou set it up.
It will make easier to develop client aplicationsapplications for your API from both anda web app or a mobile one.
Hope it helps you.