I'm writing a web application that requires access to a user's Google Calendar. I can obtain access to their calendar via Google's OAuth2.0 protocol - easy. Now, my application itself needs to expose a REST API to access data about a user when required. Here's an example flow:User Logs in with Google to http://example.comUser grants permissions to their Google CalendarWebapp stores the user in a databaseWebapp has a route /super that creates a SuperEvent resource. REST API consumer wants to create a SuperEvent so they try calling http://example.com/api/:event_id/super which would involve querying Google Calendar on behalf of the user and making some calculations on the server.My problem lies in the fact that a client of the API server (even my own since I'm dogfooding) needs to not only authenticate with http://example.com but also Google's OAuth2.0 server.Is it possible to accomplish such a paradigm or is this not a recommended approach to the problem?The only other solution I can think of is to bundle my API and static web page server into one, and have mobile clients use native OAuth2.0 bindings to talk to Google. This is a followup to my previous question
Serving a REST API authenticated against an OAuth2.0 Provider
rest;oauth;oauth2