title: Loopback 3: Implement Social auth on an api-only project
body: <p>I'm evaluating loopback 3 for a REST API only server, and I want to allow clients to login using social platforms. Most of the API methods will be restricted with access token and ACL. After investigating, I found that the common architecture for social login is</p>
  
  <ol>
  <li>Client side (browser) negotiates a valid social token with provider (lets say Facebook)</li>
  <li>Client submits the social-token to API server (loopback)</li>
  <li>Server validates the token with the provider (Facebook), creates local User, and returns access token for the REST API (of course, this must be a resolved server side with one operation called from client)</li>
  </ol>
  
  <p>I already implemented the proposed solution for social auth on loopback (<a href="https://github.com/strongloop/loopback-example-passport" rel="nofollow noreferrer">https://github.com/strongloop/loopback-example-passport</a>), but I couldn't find the way to include the upper architecture on it. Specifically:</p>
  
  <ol>
  <li>The <code>loopback-example-passport</code> includes server side views and stuff I don't want in my project (and I'm not sure what to remove)</li>
  <li>I'm not sure on which method call to validate facebook's token, create the User (it not existing) and return client access token.</li>
  </ol>
  
  <p>This is a diagram of the expected architecture:
  <a href="https://i.stack.imgur.com/z9FnH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/z9FnH.png" alt="enter image description here"></a>
  (Image credit: <a href="https://medium.com/@spyna/how-really-protect-your-rest-api-after-social-login-with-node-js-3617c336ebed" rel="nofollow noreferrer">https://medium.com/@spyna/how-really-protect-your-rest-api-after-social-login-with-node-js-3617c336ebed</a>)</p>