I need to build a REST/HTTP API that has user accounts that other sites can use.
It is my understanding that it is incorrect for the other sites(that use our API) to use a password field to allow users to log into our service. And this is mainly because the other site could log the user's password. So instead you have to use some sort of oauth like setup with tokens correct?
Is there anyway for the users to sign up and log into the service without coming to our site?
It may be that we always write the app that uses our API that's hosted on the other site. In other words, the other site would only need to plug their API credentials into the app. Does this restriction change any of the above?