I've been developing an application which will support many users. The thing is I'm unable to figure out, how to authenticate the client/user.
I'm building an app like http://quickblox.com/ where I'll give credentials to my users and they will use those to build N applications in which they can't put their username and password to get authenticated.
Let's assume it goes as follow. (Just like QuickBlox)
1. User creates account on my website.
2. User can create N API keys and secrete credentials. (For multiple apps)
(REST APIs have read and write access.)
Am I wrong at somewhere?
I'm confused to architect this three level user mechanism.