title: Authenticate custom WP API endpoint with social login (OAuth)
body: <p>I'm using Wordpress + WooCommerce in combination with the WP-API as a backend for my mobile ecommerce App.</p>
  
  <p>My goal is to offer some social login (via Facebook, Twitter, Google etc.) within the app to register/login and then use the WooCommerce API to receive e.g. all the orders of that authenticated user.</p>
  
  <p>Currently my plan is:</p>
  
  <ol>
  <li>Use some client SDK so that the user e.g. can login using his FB account</li>
  <li>From step 1 I get e.g. the users name, email and FB ID which is sent to a custom endpoint for adding the user to the Wordpress DB (like <a href="https://github.com/royboy789/wp-api-social-login" rel="noreferrer">https://github.com/royboy789/wp-api-social-login</a>) </li>
  <li>Create a custom endpoint for orders with WP-API (e.g.: .../orders)</li>
  <li>Inside the endpoint function check wether the user is authenticated</li>
  <li>If user is authenticated, the endpoint returns the user's orders using a WooCommerce API wrapper
  (<a href="https://github.com/kloon/WooCommerce-REST-API-Client-Library" rel="noreferrer">https://github.com/kloon/WooCommerce-REST-API-Client-Library</a>)</li>
  </ol>
  
  <p>But I'm struggling at #3 because I don't really know how to check wether the user is authenticated.</p>
  
  <p>I thought about creating another endpoint that will contact the OAuth authorization server to check the user’s credentials using e.g. Facebook's access token. And if the check is valid, I would create a custom Access Token for my API using some hashing of the userID, email etc. which is sent back to the client app. Then this Access Token is used for every call to my API which then reads out the User ID from the hashed token and returns e.g. all the orders for this User.</p>
  
  <p>But somehow this feels just not right. Especially because this way I'd create an endless living Access Token...</p>