I'm working with a project that uses ASP.NET Core 2.2. The main solution contains different projects, including APIs for a mobile application, APIs to integrate the system with third parties, a web application, etc.
- Mobile API - For internal application
- Public API - To integrate our system with others
- Web - Website
We're using token-based authentication for mobile API project. However, to expose our Public APIs for third parties, we don't want to use token-based authentication, instead, we decided to use the key - secret.
But the issue is that another project (integration to use our system internally) has its registered users and they don't want to create an account in our system. I suspect that, in this case, key-secret things wouldn't work. We currently use api-key for every project(tenant), and they have to keep api-key for their users. However, this could create security issues if we expose API endpoints publicly.
Along with this, we'd like to track request per user too.
What type of authentication solves this problem? and how can we handle such a scenario?