We have a web app which has certain APIs. Users of our webapp will use these APIs when they login to our webapp (like how many records me as a user do I own, user specific, etc). We are creating widgets that we plan to distribute to multiple clients.
The problem comes for authentication, basically our widget on the third party site will be communicating with our server, but the user will be logging in using the third party site's login mechanism. So when the widget on the third party site sends an API request what would be the best/standard way of authenticating the user on our app.
Also keeping in mind a few things.
- Our app has a users table, so any user using our APIs will need to have an account created on our app. That can be on demand (on first API request from third party widget we can create the user if he/she does not exist on our app user database)
- These widgets will be potentially used on hundreds of third party sites (which users various authentication mechanism for logging in to those sites)
- We have a spring boot app