I have an API and an SPA. The SPA is all anonymous but I want to ensure the caller of the API is authorized to do so.
It seems that all of the OAuth best practices, e.g. PKCE, depend on a user actually logging in, which will never happen.
Am I overthinking this?
Both apps are hosted in Azure and I've gone down the path of setting up API Management there but that doesn't seem to be a good fit for this scenario. The API is a .net core Web API so if there are solutions I can implement on the API side I'm open to those as well.