Let's say I have two web applications that are independent of each other.
App1 is written in Python and
App2 is written in Java.
After some logic is done in App1 by normal user, App1 needs to create a realm which can only be done by admin in App2.
curl -H "Content-Type: application/json" \
-H "Token: admintokenblabla" \
-X POST \
-d '{"realm":"myrealm"}' http://localhost/app2/realm/create
I can create realms through the REST API provided that I present the right admin token. The token is created after a success login in App2 (meaning I need to know the username and password)
How can App1 trigger creation of realm in App2 without any admin token? Do I need to hardcode admin's password in App1 and just HTTP request it? (sounds like a very bad solution) What is the industry standard solution to this?