I've been tasked with building an API that interacts with a couple of payment gateways to create payments.
The API has accounts with multiple users and the accounts have payments associated with them.
I need users to be able to login using email and password, pick an account and view payments created on this account, I imagine this would be done via JWT.
At the same time I need external services to be able to create/capture/refund payments, I imagine this would be done via API tokens connected to the account (like how stripe and various others does it)
Would it be bad practice to allow an API route to have 2 methods of authentication available (JWT as a user or api token as an external) and if yes what would be a better alternative that doesn't involve having 2 routes for every action both a user and an external service can perform?