I work for an ecommerce site and we are looking to expose much of our core functionality via a set of APIs. We plan on re-writing some of our own public facing websites (e.g. the main shop website) to call these new APIs also. Currently a lot of the core code is found directly in the main web app (making it difficult to provide this functionality to third parties).
I am looking at authentication options for the APIs we are going to write. JWT looks like a good fit, each API consumer (main website, some mobile app, some third-party) will request a token and then use that in requests to endpoints like /products, /offers etc. etc.
However, I am confused as to how this API can work with our public facing website's user accounts system - e.g. we have hundreds of end users who log in to the current website via their username and password that they have registered with.
How would authentication work for example, for an endpoint like users/1/orders. The JWT token would handle actual access to the API (for the consumer, such as an app or third-party) but how do we make sure the actual end user has authenticated? How should that information be passed into the main API? Would there be a 'login' endpoint that takes the username/pass in plain text? Would there be another token at this point to determine the user who has authenticated?
I don't understand how you track the fact the end user has logged in, giving the API consumer access to their 'orders' endpoint, for example.
Any advice much appreciated!