I am currently engaged in a debate and I wondered what the community's opinion on this was.
We see REST APIs which just require basic authentication (perhaps HTTP) or OAuth.
We see REST APIs which also require a signature; containing secret(s), time stamp, perhaps a nonce.
We occasionally see REST APIs which also require the request parameters (assembled in a specific way) to be included in the signature.
Number 3 offers full-fat security (although in reality and practice is there much wrong with the former?), however, it adds more implementation complexity - assembling the request parameters in a specific way creates a big opportunity to mess things up, and you can say goodbye to 'quickly testing' the API.
My security head would say 'go with number 3, idiot', but my usability head says 'that's a complete PITA, number 2 is plenty sufficient in the real world and if it's used properly - i.e. over https - there's nothing to go wrong'.