Handling Authentication with both Web App and API

Not sure how to handle this. Our current app (.Net MVC) is accessed via companyname.appname.com, authentication is handled via forms (cookie) authentication. Within the app there is a global search box that is quite heavily used, we are looking to split this out into it's own microservice so all calls for search will go to something like search.appname.com instead, therefore lightening the load on the main app. The question we have is about how best to authenticate the calls to that url. We can't share cookies across sub-domains as all clients have a different sub-domain and the sharing cannot be restricted to a select no. of domains (or not to my knowledge). Do we return an API token when they first login that we store and use for API calls or is there another way?

Apr 24, 2025 - 22:24

Not sure how to handle this. Our current app (.Net MVC) is accessed via companyname.appname.com, authentication is handled via forms (cookie) authentication. Within the app there is a global search box that is quite heavily used, we are looking to split this out into it's own microservice so all calls for search will go to something like search.appname.com instead, therefore lightening the load on the main app.

The question we have is about how best to authenticate the calls to that url. We can't share cookies across sub-domains as all clients have a different sub-domain and the sharing cannot be restricted to a select no. of domains (or not to my knowledge).

Do we return an API token when they first login that we store and use for API calls or is there another way?