I am building an application (“A”) that can interface with a 3rd Party data API (“B”). A is commissioned by Organization “X”, which has data on B. Users of A need access to Org X’s data on B. However, B has no record of A’s users.
A and B live on different servers and communicate through public internet. User’s of A login with username and password and are issued an expiring access-token that authenticates HTTPs requests to A’s data API. My question is how to best secure communications from A’s data API to B’s data API.
In other words, what is the best way to ensure request’s to B are really coming from A? Should A store some kind of non-expiring Bearer-token that B can authenticate?
Note that the developers of B have agreed to make some modifications to B in an effort provide A the data it needs, but modifications should aim to be minor.