I'm developing a REST application and I allow my clients to authenticate in several ways (typically using Authorization: Token ... as in OAuth 2.0, but also there's session-based auth option for the web-browsable API). The application allows the client to provide their endpoint to which my application would later POST with some data whenever a particular event happens.Now I wonder: what's the best way for the client application to authorise that it's my application calling?Should I roll something up myself (like, include a token derived from the client application secret, which the client app would then verify), or is there a more conventional approach I can follow?
How to have my callbacks authenticated in a REST app?
web applications;rest;http;authentication