title: API authentication with oAuth2 and first-party applications
body: <p>I apologize if this has been answered, but I have been searching for hours, and still don't quite understand. This <em>is</em> a specific question, and not a "which is best" question.</p>
  
  <p>Specific questions are in <em>italic</em>.</p>
  
  <p>I have created a RESTful API, which was at first meant to be completely open. However, the organization has now decided to create a first-party mobile app to consume and (to some degree) update the data.</p>
  
  <p>I am investigating authentication frameworks (oAuth2), and was not sure if oAuth2 was the correct way to go to meet our goals. And, if it is, which Authorization Grants applied to which set of users.</p>
  
  <p>Our goals are:</p>
  
  <ul>
  <li>To allow users to login and create accounts in the first-party app, entirely through oAuth 2 providers (twitter, facebook, google). These users would have access to the greatest set of data via the first-party app.</li>
  <li>Assign different roles to the users (admin, moderator, etc). </li>
  <li>Allow other applications to register, receive token credentials, and have limited write access or expanded access to the data. This would open them for creating third-party apps or research systems.</li>
  <li>Finally, we would like to keep some of the data completely open, with no authentication needed.</li>
  </ul>
  
  <p>So, <em>am I right in assuming that we want to setup an oAuth2 *Server* (Authorization and Resource Server)?</em> </p>
  
  <p>If so, <em>which Authorization Grants apply to the above situations?</em></p>
  
  <p>One last question: <em>For users using the first party app, would the app be responsible for logging them in and keeping their access credentials? The API server serves NO html, and is 100% RESTful. Does it need to serve login forms?</em></p>