title: Consuming own API for web app - Authentication process with OAuth2
body: <h1>Overview</h1>
  <p>I am currently in the process of creating an API for an image sharing app that will run on the web and sometime in the future, on mobile. I understood the logical parts of API building, but I'm still struggling to meet my own requirements for the authentication part.</p>
  <p>So, my API must be accessible to the world: those with guest access (non logged in people can upload, for example), and also to registered users. So when a <em>registered</em> user uploads, I obviously want the user information to be sent along with the request and to attach that user information to the uploaded image via foreign keys in my database.</p>
  <hr />
  <h1>Authentication via OAuth2 - Implementation</h1>
  <p>I have understood that OAuth2 is the way to go when it comes to API authentication, so I am going to implement this one, but I'm really struggling to wrap my head around on how to handle <em>my</em> situation. I thought of using the <code>client credentials</code> grant and generating <strong>only one</strong> set of credentials for my web app, and having it send requests to the API with its <code>client secret</code> to obtain the access token and let users do stuff. The user registration process itself would be handled with this grant.</p>
  <p>But what about when the user is registered and logged in? How do I handle authentication now? Would this require another grant to take over? I was thinking of doing some authorization process during user signin, to generate a new access token. Is this approach wrong?</p>
  <hr />
  <h1>What I need help with</h1>
  <p>I need your input on how to handle the authentication flow correctly for my case. This two-way authentication process might not be what I need, but it is the way I've understood it. I would highly appreciate your support.</p>