title: Allow token based API access to some endpoints on Azure App Service
body: <p>I have a NodeJS app running on Azure's app service. It's used by real humans, and uses Active Directory Authentication:</p>
  
  <p><a href="https://i.stack.imgur.com/GpqrY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GpqrY.png" alt="enter image description here"></a></p>
  
  <p>At the moment, requests that are not authenticated are redirected to the Active Directly login page. It's working great.</p>
  
  <p>But, I now have the requirement that another application, as opposed to a human, be able to access certain API endpoints - presumably via some kind of token authentication.</p>
  
  <p>I think options for doing this are:</p>
  
  <ol>
  <li><p>Use built-in Azure stuff. There's an example <a href="https://blogs.msdn.microsoft.com/jpsanders/2017/03/17/accessing-azure-app-services-using-azure-ad-bearer-token-2/" rel="nofollow noreferrer" title="here">here</a> of how to have a client Azure app authenticate to another, but I don't think that'll work for me as my client app is NOT an Azure app. So, I need anything - eg a <code>curl</code> request - to be able to authenticate to my app. Am I right here? Does azure have anything built in for "non-azure app to authenticate with Azure app"?</p></li>
  <li><p>I could select the "Allow Anonymous requests (no action)" option in the screenshot above, and then handle it all myself: implement an api_tokens table, and for every request, check for an API token if it's a <code>client_api/*</code> endpoint, check for an Active Directory authenticated user for any other endpoint, and manually redirect them to a login page myself if they're not authenticated.</p></li>
  <li><p>Ideally, I could say: if the request is to <code>client_api/*</code> then allow unauthenticated requests, and and I'll check the request includes a valid token, but for all other requests, do as you do now - use Active Directory auth and re-direct unauthenticated requests to the login page, automatically.</p></li>
  </ol>
  
  <p>So my questions are:
  - Am I right that auzure has nothing to make option 1) work for me?
  - Is there a way to do option 3)?
  - If not, I guess that leaves option 2) - or is there a better way I'm not thinking of?</p>