I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username together with 'some password' will be used to authenticate the user on every api call (using header fields, over SSL).
Is this a good way to authenticate the user with as little trouble for the user as possible? I believe whatsapp used a similar approach, using the device's MAC-address as the password, and let the user enter his phone number as username. I've also once read some critique on this approach, but if this is so bad, what is a better way of doing it?
So basically what i'm looking for is a way to do authentication with as little user input as possible (only a username), with at max one account per device, but for it to still be secure for calls to my api. Is there such an approach, if so, how would it go?