I could use some feedback on designing a solution for handling two OAuth flows in a single request.
I have an API that currently supports OAuth2.0 (for users).
It was requested that we should be able to shut down access to the API for a given client (eg. mobile app) - amongst other things. The initial suggestion was to implement a simple APIKEY that could be revoked, but since I already have another API that is accessed using the client credential flow (CCF) I suggested using CCF for this as well. This would have some benefits like managing the clients, build in claims/roles and more.
However the problem then arises: How does a client communicate both the users AUTH token AND the clints own AUTH token?
I am not looking for a workaround (I have a few at hand already), but rather need an official way to do this - or an explanation of why I should not.