title: Single sign-on support for REST APIs
body: <p>I am trying to find the best way to solve the following problem: our application is SaaS, and it supports SAML for web login. The application also exposes REST APIs that are supposed to be used in automated and unattended processes, meaning there is no interactive user to type credentials. We need to allow developers to programmatically authenticate the unattended process against the relevant IdP (which is already defined, because the same credentials used for API access can also be used to access the web application). </p>
  
  <p>The flow I imagine is as follows: the program authenticates using a dedicated API, gets a token and uses the token for the next calls.</p>
  
  <p>Most of the answers I find when searching for best ways to secure REST APIs suggest oAuth, which normally requires an interactive user, because they discuss an interactive application tryign to access REST APIs in other system on behalf of the user, who is there to type in the password. Is oAuth the answer for my challenge as well? If so, what is the flow?</p>
  
  <p>Thanks!</p>