I'm attempting to use OAuth 2 in order to create an protected API. Except, I want all of my users on the site to require an `access token` in order for them to access the API.

The reason being is my API will be exposed to the public, but I don't want the public to access this API. My application makes a number of calls to my API via Ajax requests.

Anyway, for example, in my application if a user clicks on another users profile, it will make an ajax request to:

```
example.com/api/user/id

```

And this will return the `json` data about the user.

But, I want them protected so an `access token` is required - even by registered users - to view them.

SoundCloud is doing exactly what I'm attempting to achieve. Every user is authenticated with an OAuth token.

```
1. Login to SoundCloud
2. Issue an OAuth token to the logged in user
3. Use this token to make API requests

```

I'm sure a number of sites are doing this, but I can't find a specific tutorial on putting together this type of `model` as I assume it's a popular model implemented on a number of sites.

What is this pattern called?