I am building an application that has an API for websites to consume services. The users can install a plugin (which includes an OAuth2 auth flow) on their website to access said services.On my application there are website models which can be associated with many users. Should my OAuth2 clients be placed under website or must they be under users?I want to place the OAuth2 clients under website as users may stop being associated with a website and break the plugin's API connection. Are there any design or security concerns if I build it this way?
OAuth2 clients under shared entities a good idea?
architecture;api;api design;authentication;oauth