I have been searching the net for an answer, but I was not able to find a similair question nor answer. So here I am.I am developing an app where a user can take a picture of a car and they will get back the car brand and possibly a model. Currently I am using an API as a back-end to recieve the picture, the API will send the picture to a different API which can recognize the car + model. The response will be sent back to my API, I will sanitize the response and send it back to the app.I was wondering if this would be a good structure or if I could do it like the picture below.Current application flow:What I think might be better but less secure application flow:New application flow:My question here is, is it possible for the last application flow to be implemented so I don't have to send a picture twice, but I can just send a picture from my app directly to the API that is not mine, get the token back and get the response that way. My concern with this is that I will need to give people with an App my API_key so they can do requests to the Api that is not mine. There is the possibility of using oAuth1 but I don't know if my api key will be secure enough that way, any advice will be appreciated.EDIT1My sanitize function in my own back-end api is too big to implement in the App itself.
Software architecture | App with API back-end
design patterns;api;sequence diagram
There are three (edit: four) reasons I would not go for this.You are reliant upon the third party API to do additional integration with your API, to return a token, and then provide a response from a token not an uploaded image. So you'd need to know they would provide that integration and maintain itYou're getting your clients (the app) to make two API calls to do a single operation and that would need documenting because it isn't a standard concept, so you'd need to document and provide support for it.Dealing with authentication is hard and requires time and thought. When you can avoid it, I'd always try to.If you're giving your API key to your clients what's to stop them following your procedure and not just directly calling the image analysis method directly and short cutting you?I agree with other commenters that option 1 is sensible. You're keeping your implementations as a black box to your clients and one day, when you find a better third party API which is faster and cheaper and does better recognition - you only need to update your API and don't need to care about that from your clients point of view.If you're worried about transfer speeds, why not look at some image resizing on the client first, or have your client upload to something like Azure blob / Amazon S3 storage and just pass around URLs?