I have built an API on AWS for use by (paying) business customers. A business's website will call the API when one of their users needs to use a particular function on that website (I can't go into detail as it's commercially sensitive). The end user has no direct connection with my API at all or an account with me.
Particulary as this will be a paid service it of course needs to be secured.
However, despite having read the documentation and a few articles, I'm still confused about what and how to implement it for my use case. Nothing uses my business case as an example.
It looks to me like Cognito user pools is what I should use, but the difficulty I'm having is that it seems to approach the situation as if it's my website that's making the API call.
If I create a user pool and an app client, I know the client ID and the client secret. I don't want to know the client secret because that's effectively my business customer's password to the API. The app client would be my customer's web server that needs to authenticate a request with Cognito to call the API. I also need to track which customer makes which API call so I can charge them appropriately.
So how do I set up a business customer and securely provide credentials to them so that they can make API calls?