Authentification using API
<p>I've worked on several websites few years ago and I want to be up-to-date with "the new web" so I'm working on a website using Laravel and Lumen to practice.</p>

<p>I have an architecture like that:</p>

<ul>
<li>An API using Lumen (with databases: users data, user preferences, …)</li>
<li>A website (without database, this part just ask to the API some data and allow the user to be connected to his account)</li>
</ul>

<p>Currently everything in my API is public: retrieving users, deleting accounts, searching users, etc. </p>

<p>The problem is that I don't know how to allow situations like that:</p>

<ul>
<li>Allow my website to execute actions calling the API (call private routes on my API)</li>
<li>I would like to have some routes public on my API (the easiest part, it's done actually)</li>
<li>I would like to allow external users to call my API if they have a valid token (Google analytics, Bugsnag like services)</li>
</ul>

<p>I'm thinking about services like Google analytics, Bugsnag, …: this services ask the user to put a token/key in Javascript. Is it a problem if someone take the token and use it on his personal website and/or in a mobile application? </p>

<p>I've read about o-auth 2, is it the place to start?</p>

<p>Thanks!</p>