REST API for website which uses Facebook for authentication

Question

We have a website where the only way to login and authenticate yourself with the site is with Facebook (this was not my choice). The first time you login with Facebook, an account gets automatically created for you.

We now want to create an iPhone application for our site and also a public API for others to use our service.

This question is about how to authenticate with our website from the app/API and is broken into 2 parts:

1. What is the correct way to handle REST authentication from an API to a website which only uses Facebook OAuth as an authentication method?

I have read and researched a lot about standard methods of authentication for REST API. We can't use such methods as Basic Auth over HTTPS, as there are no credentials for a user as such. Something like this seems to be only for authenticating applications using the API.

Currently, the best way I can think is you hit an /authorize end-point on our API, it redirects to Facebook OAuth, then redirects back to the site and provides a 'token' which the user of the API can use to authenticate subsequent requests.

2. For an official application that we create, we wouldn't necessarily need to use the public API in the same way. What would be the best way then to talk to our website and authenticate users?

I understand (I think) how to authenticate 3rd-party applications that are using our API, using API (public) keys and secret (private) keys. However, when it comes to authenticating the user who is using the app, I am getting rather confused about how to go about it when the only way we have to authenticate a user is Facebook.

I feel like I'm missing something very obvious, or don't fully understand how public REST APIs should work, so any advice and help would be greatly appreciated.

Answer 1

UPDATE: see below

I've been thinking hard about this question too. It's not entirely clear to me yet but here's the route I am thinking of going. I am creating a REST API an my users only auth with Facebook connect.

On the CLIENT:

1. Use the Facebook API to login and get an OAUTH2 code.
2. Exchange this code for an access token.
3. In every call to my custom API I'll include the Facebook user id and the access token.

On the API (for every method that requires user authentication):

1. Make a request to the /me Facebook graph using the access token from above.
2. Verify that the Facebook user id returned matches the user id passed to my API from above.
3. If the access token has expired additional communication is required.

I have yet to test this. How does it sound?

--- Update: July 27th, 2014 to answer question ---

I only use the above exchange once upon login. Once I determine which user is logging in, I create my own access token, and that token is used from that point going forward. So the new flow looks like this...

On the CLIENT:

1. Use the Facebook API to login and get an OAUTH2 code.
2. Exchange this code for an access token.
3. Request an access token from my API, including the Facebook token as a parameter

On the API

1. Receive access token request.
2. Make a request to the /me Facebook graph using the facebook access token
3. Verify that the Facebook user exists and match to a user in my database
4. Create my own access token, save it and return it to the client to be used from this point forward