I'm trying to understand OAuth and Securing APIs better when using External Identity Providers, and all my research on it doesn't really seem to apply to my issue, so I'm starting to wonder if I'm approaching what I'm doing completely wrong at this point.
I have a SPA that is an item manager for a game, it has a custom API (this is also mine) that it gets all of it's data from, such as the items from the game, and saved setups, etc. Users can login to the SPA using their Discord account, which let's them save their setups against their account so they can retrieve them later, among other minor features, that's the main thing.
As the website can be used without login, I was allowing the API to be accessed without any authentication, then adding authentication to it when the user has logged in to give elevated permissions on the API.
My current login flow is:
- App performs an Implicit Grant to Discord
- Discord Access token returned to App
- Discord Access Token is passed to API as a Password Grant, with username
discord(I'm sure this is a very bad way to do this, but this is the main reason I'm making this post)
- API returns Access Token for accessing the rest of the API
While my current system works, I'm sure it's not the best way to do it, and as I've had requests to make the API open to others to use, I want to make sure this part is all squared off and working well first.
Would appreciate any help anyone can give with organising this mess