title: How to design API to be used by untrusted 3rd party
body: <h2>Background</h2>
  
  <p>I need to design a WebService REST API. This web service will be consumed from a Web page and some mobile apps (android and iOS). I will call all of them 'apps'. Apps will be developed by third parties, outside of our company. Mobile Apps requires a logged in user to display content, so it's easier for me to handle content authorization of my web service.</p>
  
  <p>Web page is a bit tricky because it must provide some functionality even for non logged users, (eg: list latests products, display product details and search products), so even to non-logged in users:</p>
  
  <ul>
  <li>It must be able to request some data (mostly /products and /products/{id} ) from my web service.</li>
  <li>It must be able to consume /search endpoint.</li>
  </ul>
  
  <h2>Real question</h2>
  
  <p>I will use OAuth2 to handle authorization. On mobile apps this is not a problem, they will not be able to access any content until they get authorized, so once authorized all API will be working.</p>
  
  <p>But I'm totally lost on how to handle connection with web app. </p>
  
  <ul>
  <li>Should I leave some URL non-authorized to allow web dispatch content to non logged in users?</li>
  <li>Should I create a special user 'anonimous' with higher API usage rate limits and tell Web app to authorize as 'anonimous' until user has been logged in ?</li>
  </ul>