使用OAuth2.0授权Rest API

Question

I am developing a REST API using node js and express js. For example, my RESTful API end points are as follows

/api/v1/books/:id
/api/v1/books

I want to authorize the end points only for specific application(web, android or ios).

**The users of the application may or may not authenticate in the application.

ex: www.bookstore.com
bookstore android/ios app

ie. only these applications can have access to those end points. How can I implement this using OAuth 2.0 and JWT

For example we can view every item in amazon(web/android/ios) without providing login credentials.

How can this be implemented.

Answer 1

Jwt and Oauth is used for user authentication and authorization. Here, I believe you want only specific clients to have access to your APIs. For this purpose you may use joi validator available on npm registry. npm install joi. Now provide a schema for your app type and make it required.

Answer 2

The flow that you describe is a typical " client credentials grant ":

The client credentials (or other forms of client authentication) can
be used as an authorization grant when the authorization scope is
limited to the protected resources under the control of the client,
.... Client credentials are used as an authorization grant
typically when the client is acting on its own behalf (the client is
also the resource owner) ...

in this use case, the end-user is not required to login, only the client-id, which is your app.