Web Service Authentication Options

While I have played with web services many times and have created quite a
few that really only get used internally I now have a project where I need
to provide a group of services to mobile devices.

There are numerous ways of providing authentication.

The authentication I am referring to is at the web service level not the
transport.

One example for web services we consume regularly requires the following;

- Initial connection with a user name and password - if successful a
token is returned
- All subsequent calls require the token to be passed.
- The token expires five minutes from creation

The web services to be deployed will not receive a large number of calls
and the purpose is to verify if an account is active at the start of a
shift.

Just looking for any advice, comments, suggestions from the group.

Thank you

Don Brown