title: How do I secure my REST api developed in playframework
body: <p>I have read a lot about this on here and other articles. First let me explain my situation.</p>
  
  <p>Let's say I have the following REST backend:</p>
  
  <p><code>GET /user</code> returns all users in JSON. (No need to be logged-in)<br>
  <code>POST /user</code> registers new user.  (No need to be logged-in)<br>
  <code>DELETE /user</code> deletes a user. (You <strong>do</strong> need to be logged-in)  </p>
  
  <p><code>POST /login</code> posts login credentials and returns a 200 OK on succesful authentication. Also this creates a <code>session</code> with the <code>username</code>.</p>
  
  <p><code>DELETE /login</code> logout, this deletes the session.</p>
  
  <p>For user authentication and roles I use Deadbolt-2 so for example when <code>DELETE /user</code> is called first the <code>session</code> will be viewed to determine whether you are logged-in and then the <code>username</code> is used to determine if you have the correct permissions.</p>
  
  <p>This <strong>works</strong>. My question is not about this kind of authorization/authentication. It is however about the following:</p>
  
  <p>I want to secure the "public" API calls like: <code>GET /user</code> in a way so only front-end applications that are <strong><em>approved by me</em></strong> can access them.</p>
  
  <p>I have read a lot about api-keys and HMAC and oAuth. But it seems to me they are talking about the first scenario and not the second. So how would I go about this in my situation ?</p>
  
  <p>Thank you for your time.</p>