title: How to securely let an app access a different app using OAUTH and client credentialing grant flow?
body: <p>I am new to OAUTH and API access and authorization and have been reading about it to conceive a high-level solution for integrating two applications.</p>
  <p>I work for company A which makes product A. Product A is hosted on Azure and is a RESTful API. We were acquired by company B which makes product B and product B client-server and not hosted on the web.</p>
  <p><strong>Product B</strong> has its own data center and <strong>Product A</strong> on Azure. Product A has separate instances for each of our clients like client1.productA.com, client2.productB.com, etc. Prod A is single-tenant only for now.</p>
  <p><strong>Product B and A</strong> will share the same clients in the future.</p>
  <p>Instances of Prod B talk to instances of product A by sending JSON requests and receiving a response but before that, someone from product A logins into the product A UI with admin roles and has to generate a bearer token and share it via encrypted email with Product B folks and they plug that bearer token into their environment variables and then the flow starts. This can take 2 weeks of exchanging emails and whatnot.</p>
  <p>What we are trying to do is remove manual intervention and automate it between A and B. Product B has OKTA as their IDP and has OIDC. Product A is ADFS with SAML 2.0 and also supports OIDC. Basically, Product B should request access to Product A API, and Product A should verify it is product B and then share the access token for server-server flow.</p>
  <p><strong>Question</strong>:</p>
  <ol>
  <li>how can product A verify product B's request to access it? Will product B's IDP (OKTA) be used to verify product B's request or will it be product A's ADFS?</li>
  </ol>
  <p>I am trying to draw up a workflow solution however I am not sure if I am on the right path.</p>
  <p><a href="https://i.stack.imgur.com/0SrlI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0SrlI.png" alt="enter image description here" /></a></p>