Solution Overview

I found a solution to the problem:

• API Separation: I created a separate API application to handle all API-related operations.
• Access for Regular Web Apps: The regular web application can access the API by obtaining an access token. This is done by executing a Client Credentials Grant exchange.
• Access for Native Apps: The native app can use the Authorization Code Flow with PKCE (Proof Key for Code Exchange) to achieve the same purpose of securely accessing the API.

This approach allows both types of applications to authenticate and interact with the API in a secure and efficient manner.