In order to secure a RESTful API, what are some good approaches to generate tokens (which would expire after a certain amount of time) for the clients? The token will be sent to the client in response a login request with username/password. Specifically, I want to implement this in PHP.
Also, does this method of authentication follow the OAuth spec?