App1 through REST API create something that only admins in App2 can do

Question

Let's say I have two web applications that are independent of each other.

App1 is written in Python and
App2 is written in Java.

After some logic is done in App1 by normal user, App1 needs to create a realm which can only be done by admin in App2.

curl -H "Content-Type: application/json" \
     -H "Token: admintokenblabla" \
     -X POST \
     -d '{"realm":"myrealm"}' http://localhost/app2/realm/create

I can create realms through the REST API provided that I present the right admin token. The token is created after a success login in App2 (meaning I need to know the username and password)

How can App1 trigger creation of realm in App2 without any admin token? Do I need to hardcode admin's password in App1 and just HTTP request it? (sounds like a very bad solution) What is the industry standard solution to this?

Answer 1

It's true, saving passwords in your app is a bad idea. I typically solve this by not using passwords. I use https for my rest.

You can do basic authentication and send credentials on every request or you can set up an auth token that is ephemeral to make successive requests more light weight. This isn't an "admin token". It's a temporary way to quickly say, "hey it's me again". After a reasonable amount of time it expires and you have to send credentials again to get a new auth token.

I recommend you check out this similar stack overflow question:
restful-web-service-how-to-authenticate-requests-from-other-services