title: How to authenticate client on multiple OAuth2 providers?
body: <p>My REST API (api.example.com) is currently an OAuth2 provider and has been the support of a mobile app. </p>
  
  <p>Recently we have created a new web-site(www.example.com) which will be treated like any other client. The web can authenticate on the API by using a <strong><em>password grant_type</em></strong> where a user types in her credentials. From there the client(browser) gets an access token and can than consume the API. </p>
  
  <p>The problem comes that we want to authenticate clients on the web-page using Facebook. </p>
  
  <p>So basically, the web should in the end be able to get an user access token to access the API by logging in via Facebook. </p>
  
  <p>I've looked around and I've seen two legged and three legged OAuth2 authentication scenarios but: </p>
  
  <ul>
  <li>How does that applies on the scenario I just described?</li>
  <li>What is the right way of doing this? </li>
  <li>What are the security issues I should take into account? </li>
  </ul>