I know they both prevent the RESTful APIs from abuse. Hmac signed api is commonly used than the other. But I think using user/pass pair for authorization is more security, here's the reason:
To sign an api using hmac need a shared secret between client and server. So the server MUST store the secret in a computer readable(reversible) format. If the server get cracked(it's not a small probability event), all it's users are in danger.
While using user/pass to authorize client, server could save hashed(with salt) client password to database. Then it is useless after stolen. Plus using tls/ssl to protect the password during transfer, there's no MITM attack.
So the truth is most companies use hmac signed api. Could someone tell me what I've missed?