REST API和移动应用的认证策略

I'm creating a REST API server with Node.js and Express + MongoDB. This API will have different mobile clients (iOS, Android) and possibly a web app later on. I need users to login in order to perform some API requests. There are no 3rd party apps I want to connect with (no Facebook, Google etc). I also don't want to force the users to visit a webpage or anything like that in order for them to login.I'm creating a REST API server with Node.js and