Yes, and - for one - really hope the eventual API builds on stuff they've already pushed in the past, and doesn't go in a whole new direction. I very much want to see OpenSocial, OAuth, GData / AtomPub, and existing open standards used for whatever they cook up. And given how much Google have put into these various standards in the past, it's what I expect... I just can't shake this sneaky fear that they're going to hit us with a big swerve and roll out a lot of new, incompatible stuff.
I hope they don't. OAuth is a nightmare (I just tried to make a simple client for IOS, right now I want to beat up the guy who made that standard) and the rest is far more complicated than a simple json based rest api.
Well, if you don't use OAuth, then what? You'd have to have something roughly equivalent to deal with authorizing API requests, no?
As for GData / AtomPub and REST... AtomPub was designed specifically to be a restful protocol, and GData is heavily based on AtomPub... but also has a JSON mode, so you get your wish there.
Anyway, the point I was getting at isn't about any one (or two or three) specific items of how they implement their API... just a hope that they stick (mostly) to established / open standards. By the same token, I hope Google are - or become - involved in the Federated Social Web initiative and adopt the work that comes out of that. But that's just me...
I would use password based authentication. The pattern is well established, users know how to deal with it and it is simple from an implementation point of view.
If you don't want to do that, then let me just pass as a parameter a nonce and then, if the user clicks agree or whatever, allow me to use that as the password.
Just skip the consumer secrets, token, two or three step authentication and HMAC based authentication. It is a social media system, not a stock-trading application.
