REST API-身份验证与授权？

Question

I am creating some APIs and I am confused about how my application will authenticate, basically because I feel I need 2 authentications and I cannot find any information about this.

1. Authentication with the API Server (so my app will be able to retrieve data and sync even if no user is logged in)
2. Users authentication

Is one endpoint (ie /login ) enough to manage all this?

Any ideas?

Thank you!

Answer 1

In this case, use an HMAC on the incoming request with a preshared key to authenticate the user. Then on your resource (in the Controller), validate that your user is authorized to access the route.