I'm developing a REST application and I allow my clients to authenticate in several ways (typically using
Authorization: Token ... as in OAuth 2.0, but also there's session-based auth option for the web-browsable API). The application allows the client to provide their endpoint to which my application would later POST with some data whenever a particular event happens.
Now I wonder: what's the best way for the client application to authorise that it's my application calling?
Should I roll something up myself (like, include a token derived from the client application secret, which the client app would then verify), or is there a more conventional approach I can follow?