I have written an API for my latest project. Written entirely in PHP, it currently supports web and mobile applications. We would like to expand that to desktop applications as well, but I’m not exactly sure how to enable to user to login through the desktop application, while still protecting the username and password from said application.
There are many brilliant developers on Stackoverflow, so shoot me some brilliant answers!
If the application has to send usernames and passwords, then it has to be able to have access to them, so don’t use them inside the application at all.
Use OAuth. This is the solution used by quite a lot of large organisations, including Twitter.