0

I need to build a REST/HTTP API that has user accounts that other sites can use.

It is my understanding that it is incorrect for the other sites(that use our API) to use a password field to allow users to log into our service. And this is mainly because the other site could log the user's password. So instead you have to use some sort of oauth like setup with tokens correct?

Is there anyway for the users to sign up and log into the service without coming to our site?

It may be that we always write the app that uses our API that's hosted on the other site. In other words, the other site would only need to plug their API credentials into the app. Does this restriction change any of the above?

  • 2
    Is there anyway for the users to sign up and log into the service without coming to our site? Yes. It's named OAuth, Oauth2, OpenID, etc. Looks like you have to implement your own Authorization server. – Laiv Nov 26 '18 at 12:47
  • As Laiv said, yes. But you have to publish your API for others to be able to use your service, which they won't do until you have users. And you won't have users if they can't use your service for something else. google, fb, et al are able to do it because they had a massive user base first and then added the ability to use their auth services... – ivanivan Nov 27 '18 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.