hi all,

I'm designing an app which will have 2 parts;

• a (server-side) token request service which has an access token to operate the NB API
• a browser based app which will needs to use the NB API, so requires its own access token

I'd like to restrict the usage of the browser app to people with current credentials in my NB site, and potentially tagged in a certain way. Something like this;

1. user posts credentials (userid, pwd-hash) to my token request service
2. my service uses the NB API to check the user's credentials (userid, pwd-hash) 
3. if good, the service requests a new access token for the user and returns it to the user's browser ... this is the reply to the request (1)
4. user's browser app can now operate the API and do something useful.

Is there an API call to support (2) ??

Is this a reasonable pattern?

Nick