When ansering questions like "How do you do Authorization in REST" you have to read various chapters:
http://docs.camunda.org/latest/api-references/rest/#overview-configuring-authentication
http://docs.camunda.org/latest/guides/user-guide/#process-engine-authorization-service
http://docs.camunda.org/latest/guides/user-guide/#process-engine-identity-service

And actually depending on where you start you will not easily find the big picture or understand that from AuthorizationService you might still want to exchange IdentityService.

It would be really cool to have a big picture overview and the corss-references, that you can answer this question easier.