Which credential mechanism does OAuth 2.0 use for REST API authentication?

OAuth 2.0 primarily uses access tokens for REST API authentication. An access token is a credential that represents the authorization granted to a client by the resource owner. The client presents this token to the resource server to access protected resources. This mechanism provides a secure and standardized way for third-party applications to access user data without exposing the user's credentials. Username/role combinations are typically used for direct user authentication, not for delegated authorization as in OAuth. Cookie authentication is common for web browser sessions but less suitable for API authentication due to statelessness requirements and cross-domain challenges. Basic signature workflow is not a standard OAuth 2.0 credential mechanism; OAuth relies on token-based authorization.