I have a few microservices that i would like to combine in form of an api. The main purpose of the api is to be used by our (first party) mobile app. A side note, we don't have a mobile app or web app right now and we want the backend completely decoupled from the frontend. But i can see that soon a few third parties might need access to the same api as well. I have designed the api with the basic endpoint for all the type of resources. My question is regarding the authorization flow of the api and client.
I am leaning towards using Oauth 2.0. Password flow for our own app (first party) and Authorization flow or Authorization flow with PCKE depending on the kind fo third party client. Is it a secure way to solve it ? How is it typically done ?
So for a third party developer, the flow would be something like this. They signup using our mobile app, create an app (client id and secret) and then can use it for authorization. This leads me to one more question
1) Would it be safe to expose the signup and create an app endpoint to third parties ? Or only our app should be capable of creating apps and signing up new users ?
