We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, we have a client application that will be allowed to connect to our server APIs. The UI and back end (REST) may be on the same server or different server.
My front end team tells me that given that this is an internal app, we don't need to secure them with oAuth, just as we would not need a key for each room of our own house. We can just use Tomcat IP restrictions as to what servers/IPs can access these APIs. It would be unnecessary and overkill to use oAuth type authentication for internal apps.
Is my front end team right? What is the advantage of securing REST APIs with oAuth for internal apps? We don't plan to use SSL initially, as this is a consumer, SaaS application