I have a api app that sits behind a few client facing apps. The client facing apps have users that login to them and then request resources that the client facing apps in turn request from the api app.
The api app keeps track of who is allowed certain types of resources. The client facing apps are nto meant to know the details.
If i want the api app to know what client the request is for, so it can decide whether the person has permission, what should the client facing apps pass to the api app?
Should I add a unique identifier to the user model that can be used to refer to a user?
You should definitively consider the existing apps that help making an API with access control.
This should get you started in configuring your API rather than implementing it from scratch.