I'm developing a OAUTH service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants.
basically users can purchase goods from Merchant's E-Commerce website and can use our payment gateway to do the payment.
we have registration system for merchants and users and we are issuing a ID (publicly available alpha numeric ) to them.
My plan is for OAUTH service.
- First merchant sends above mentioned id to our OAUTH server.
- Then OAUTH server sending token, refresh token and expiry time as response.
- Then merchant sends that token with other required information such as amount again to OAUTH server to open our payment gateway web interface.
- user use that interface to provide his ID and pin to confirm the transactions.
- Then from over OAUTH server we call our back end RESTful service to do the actual transaction (Merchant account receive money and customer account will debited)
- After completion of transaction we redirect user again to merchant's website.
*All the communications are done via HTTPS channel.
I'm in doubt for
- Whether my approach is correct to secure the above given flow.
- Do I really need a tokens here or only ID is enough? If I only used ID what I'm going to missing here.
- If so only ID is enough to obtain a token?
- Is there any possibility that some one can cheat the process.
Expecting you advices on this.