So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code into the  existing codebase is to find a way to authenticate to the new site and leverage the APIs that are already there. My first thought was to create an API token authentication for the new APIs and rely on that for communicating from our client to this new backend but I don't think this will be enough. The data is sensitive and the thought of having API keys that can be easily taken from our client app I don't think is a good fit for this project. My second thought was along the same lines as API tokens but have them created only when the user logs in to the existing site. The existing site would create, store, and send some piece of identifying information after the SAML authentication that the new back end can use to identify the client as being legitimate when it sends this with the request. This makes sure the user has to login to our site first and there's no private/public keys here to take... I think.Third is just mirror the new API in the existing app and just make the new APIs not reachable from the web then just proxy calls from our existing app to the new app. Any thoughts and criticisms of these ideas is welcome or what other people have done to solve this kind of problem where they have a running web app with authentication and need to add new services that come along. 
Adding new service to authenticated website
architecture;authentication;authorization