How to verify a token in the url of a drupal 7 site against an external web service and skip the login form all together? Context

We have this JSON web service GET https://api.my-domain.com/accounts/me (and a bunch of other endpoints). It takes a token in the header. When that token is valid it will return

{
  "email": "me@my-domain.com"
}


That JSON web service is used by a web application. That web application links their users to a Drupal forum. We don't want them to log in again.

The simplest solution we could think of is to link the users to:

https://drupal.my-domain.com?token=123456789

The Challenge

Our challenge is for our Drupal instance to:


Read that token from the URL https://drupal.my-domain.com?token=123456789
Call our web service GET https://api.my-domain.com/accounts/me with header Authorization: token 123456789
If it responds with a status 200 response and {"email": "me@my-domain.com"}, have Drupal pick up the email value.
Drupal matches it against the drupal users.
When the user doesn't exist in Drupal, it has to be created.
And the user is logged (SSO) into the Drupal forum.
No login form was ever shown. The token was either correct (status 200 from the web service) or incorrect (status 403 or whatever) and some drupal node/page should show that an invalid token was used accessing the forum.


I have done some investigation but none of the solutions that I found quite matched this use case. Most show how to build a module and have the login form check against an external system. We don't need the form. Just a token in the url validated without a form. I don't want to build a fully fletched CAS-Server, OpenID or OAuth2 provider at the web service. We'd like to keep it simple and just verify one token in the URL against our web service.

Can we use a module for this? And how would the simplest version of this module look like?
So, I don't have a working solution for this (yet!) but I'm working on a similar use case. From what I've read, you can't really have an authenticated user do anything on a Drupal site without passing them through the user module, creating a user, and storing info about them in the database. 

I believe you need to write a module that passes a user object based of the email in your json response to user_external_login_register passing in some sort of programmatically populated dummy text for the extra fields you need, and then programmatically create the user and log them in in the background. In theory, all you need to do is pass the user object based off of your 200 response, and proceed to create and log the user in.