Securing your REST service API layer is not just about considering whether you should use OAuth 2.0 or not, or whether REST needs something like WS-Security. It is about considering why you should care about security, who you are protecting your service against, what the risks are, and more general security principles than just authentication and authorisation.
Why?
Do your service API need securing? The answer to this will depend on your business, and the nature of the service, but you will want to consider whether there are any reputational, financial or regulatory consequences to a security breach of your service, and if so, how to deal with it appropriately.