To solve our authentication problems, Flask-Login could be used and the cookie data from the login could be checked. However, this would require developers who wish to use our API to have their program login through the web interface. We could also have developers send their login data with every request, but it's a good design practice to only send sensitive information when absolutely necessary. Instead, our API will provide an auth/api endpoint that allows them to send login credentials and get an access token back.

For the authentication mechanism, we are going to use JSON Web Token (JWT) to create access tokens for the consumers of our API upon login. A JWT token asserts which user is logged in, thereby saving the server another call to the database for authentication. This token has an expiration date encoded inside it that will not allow the token...