I have a unique situation that I'd love some help with if possible:
My company manages a lot of WordPress sites. Each site has its own unique set of users (same users throughout all sites, but some only access X, others access Y, others both X&Y, etc). We use a custom SSO plugin to manage all that, with permissions and the like, which all works perfectly.
I've built an app in Laravel, that has both public and private routes. I use Laravel Passport/OAuth to access the private routes. Everything on that front works perfect, also.
However, I am now posed with the situation where I need to have the WordPress users access some protected routes of my API, without asking them to login to the API separately.
I know a lot of the interest in WP/OAuth is basically the opposite to my situation, where people want to login to WordPress with an OAuth service provider (Twitter/Google/LinkedIn/etc), not the other way around.
Both the API and WordPress sites are hosted on completely different architecture, and no means to access one or the other's database.
What I'm looking for is a straightforward way for my WordPress users to "Authorize" themselves on my API, without needing to maintain two sets of the same users. Ideally, the WordPress user would not necessarily be created in the API, but I use audit logs to track who does what in the API, so being able to determine who did what would be great.
Any help, or experience from people in a similar boat would be great!