How to authorize a user when working with the API?

Question

API

Good day. Such situation.
There is some chat. I am writing an application for it for mobile phones, hence api (restful). The question arose. How to authorize a user? We get a password and login from him, we understand that such a user exists and everything is generally fine, we return a response to the application that they say TRUE, everything is fine. What's next? After all, neither sessions nor cookies can be used in fact, because the restful api should not store any state, or a permanent connection with the application. Explain this point, please.
PS, the API is written in php.

Answer 1

tokens. Upon successful authorization, it is created, written where (for example, to the database) and returned to the user a token (random string). The client will simply send it in the headers and it will be used to authenticate and authorize the server.
If you are interested in ready-made options - WSSE