[James Ward] When doing a human-to-machine integration you should use the OAuth web or mobile flow so that the credentials never pass through the integration application. In the case of machine-to-machine integrations, the integration must have an integration user’s credentials and use either the username & password OAuth flow for REST or direct authentication for SOAP. – Learn more at Salesforce Developers Blog