One of the best practices to secure REST APIs is using password hash. Passwords must
always be hashed to protect the system (or minimize the damage) even if it is compromised
in some hacking attempts. There are many such hashing algorithms which can prove really
effective for password security e.g. PBKDF2, bcrypt and scrypt algorithms.
Other ways to secure REST APIs are: Always use HTTPS, Never expose information on URLs
(Usernames, passwords, session tokens, and API keys should not appear in the URL),
Adding Timestamp in Request, Using OAuth, Input Parameter Validation.