REST API security

Hi,

I'm having some trouble in creating a rest api with authentication. Here's the problem: all my users are registered with an user name, email, and api key (secret). Also the domain ip.

When they do a request, a visual form must appear (in html - pushed from my website); when submited, the results are placed inside a div in the same html code.

How do I authenticate the user for using this service?

I was thinking that first of all (step 1), the user should make a request to my server with his api key and receive a token (same api key + time on my server, all hashed).

This token and the api key should be inserted in the form automatically (if the domain and authentication is correct in step 1) when I send the html code to my user.

When submited, my main script would decrypt the token, and compare the api key (again) and the time diference.

The problem is: when I return the data in the div, should I generate a new token?

This script has holes all over the code - it's a feeling...

Can someone help me out?

Kind regards

Kepler