How is customer_id generated for a non-authenticated visitor?

I’d like to allow users who are not logged in to add items to cart. Since my setup is communicating through a RESTful API, sessions will not be available. My current guess is that I need to generate a unique customer_id based on some random calculations, and then send this on every request, when say adding, removing or retrieving cart?

Additional information on this key element in the plugin would be great!