I've been reading a lot lately about Web API authentication mechanisms and I'm a little bit confused regarding how to implement my Web API authentication mechanism, I'm thinking on using Token based authentication but I'm not sure if it is the right choice.
Basically my Web API will manage all the operations needed and it will store the users of my website as well the API users.
I want to support the following
- User can register on my website and apps using their G+ or Facebook account or an already created username from my service, as well they will be to login using their social account.
- If the user is not logged in they won't be able to post Items but they will be able to see the Items, think something like Craiglist.
- Let's say the user is a developer and they want to post the items through some software they created instead of going through the website and posting one item at a time, how do I allow this?
Now, my questions are:
When a user registers on my website, do I have to create a (public key/ secret key) for it subsequent access token , so I can use my API from the website as the user checking if they have access to certain endpoints?
Do I have to assign a (public key / secret key) for my website so I can consume the API when the user is not logged in?
The same as above for mobile apps
How do I allow users to (sign up / sign in) using G+ or Facebook?, if they log in using any social network how am I going to secure my api?