I have an API which include a registration and login process. Both process have an authentication sub-process. This sub-process are many steps which API validate a client specific data.
I have many doubts about names for authentication process. This is my approach:
Registration process (It creates an account)
POST /accounts/authentication (start authentication process, generate internal keys but doesn't return any token) POST /accounts/authentication/data1/validation (validate data1 of client)
Login process (When client want to access his created account)
POST /sessions/authentication (start authentication process, generate internal keys but doesn't return any token) POST /sessions/authentication/data1/validation ( validate data1) POST /sessions/authentication/data2/validation ( validate data2)
Additionally, I have a service which return the data (data1 or data2) that I should validate in a next step.
( I can't specific the real name but My approach it should be a plural noun)
Well, I would like if my approach is correct.
Firstly, I have a token which is generated previously. I sent this token in headers. Then, the first service (
.../authentication) generate internal tokens. The next services validate these tokens internally. Due to security reasons I can't use these tokens in URL's.I have a Redis DB which support all process.
Regarding to the another service (
.../data1/validation). "Data1" is an specific data attribute of the client. According to business rules and application flow, I need an specific service for validating this specific data attribute.
I hope my additional explanation could help you to understand my problem.