title: Confused about an existing website with OAuth but now we add an API to the site
body: <p>I'm writing an API for our product and I'm trying to understand how some basic OAuth works with regards to mobile apps that might leverage our (to be created) api.</p>
  
  <p>Lets imagine that our website currently allows a person to LogIn to our site via Twitter OAuth.
  On the callback from Twitter, our server retrieves the twitter OAuth result and if all good, then checks to see
  if this user already exists in our DB (eg. lets assume the Email is the unique key). If they don't exist, we
  create a new user.</p>
  
  <p>Of course, we then log the user 'in', which means we create a cookie for them, for their browser.</p>
  
  <p>So far - nothing new here. All normal stuff.</p>
  
  <p>Now .. if we want to do this via an iPhone or Windows phone using their native language and the app's use our API, i'm not sure of the point where OAuth ends and our API takes over?</p>
  
  <p>For example, lets pretend it's an iPhone app that takes advantage of our API.
  The iPhone app will try to authenticate the user against their Twitter cred's. Ok, fine. But when it callsback, it's back in the phone, right? Not our servers. So then the app needs to try and create a new user? So then the iPhone might try and call <code>/api/CreateAccount</code>. But this means -anyone- can call this api? And how does the website really know they have authenticated? Only because the app says so? What's to stop the person from creating a malicious app and calling our API by flooding it with new account creations? And what about authentication to api resources? Forms Authentication isn't available here. So do people use querystring authentication over SSL for api calls? How does the iphone authenticate with -our- server?</p>
  
  <p>I'm so confused.</p>
  
  <p>Can anyone please explain the differences and common practices people are doing these days when they have a website and an api .. and use OAuth as the authentication mechanism, please?</p>