An external software provider is hosting a website for us. We supply the login functionality via a restfull api(login/password over ssl). But the website is also the client for OAuth resource that it can access. This would imply that the user of the website who is already logging in with it's website credentials should login again to the OAuth resource.
We would like to make it easy for the user. So what are the option to not make a double login?
As i understand OAuth correct, it is not a good idea to store the token. So is it possible with every restfull api login to also do a OAuth login and pass the token to the website?