I want to build a REST API where applications can authenticate using an OAuth2 Bearer Token, so they get access only to resources related to one user or they can access by itself accessing resources for their own application or general resources. Therefore I ask myself how to authenticate these applications when they access on their behalf.
So for example, I have the resources
User resource is only accessible for the user itself or for an application who got a bearer token by the user. Therefore I use the Bearer Tokens.
Then there are many
Post resources which belongs to a
User resource. An application can access it by having the Bearer Token and get it through the User ID or by accessing it through their own application access and getting it by search or by the post ID.
Now I'm undecided whether to use the
client credentials flow or to use the client secret included in the OAuth2 flow as an api key to access this post by its post ID.
Shall I use the
client credentials flow of OAuth2 or can I use the Client Secret used for OAuth2 also as a way to access general information.
Important to me is that sensitive data, like email addresses, can only be accessed by applications when they have a Bearer Token, while data that might be accessed by applications is just protected behind a suitable authentication for these applications.