I'm trying to build an application similar to Spotify, where users can access particular content if subscribed. I'm trying to use Microservice Architecture to build this. The client is an android app.
So for user Authentication, I have an "Account Service". It makes use of the Oauth2 code to authenticate the user. For accessing content, I've made a service called "content service" which would authorize user access to content, thereby giving them a signed URL to the content (link to .mp3 in this case).
Now, how do I authorize the user requests at "content service". All subscription details are stored in the "Account Service" database. I don't want it to communicate with account service, as that'll defeat the purpose of using microservice architecture.
so to solve this, I was thinking of making use of digital signatures. Have the account service generate a key pair, send the public key to "content service" or some other Keystore service. specify the access/authorization in JSON, sign it, and send it to the client. When a client wants to access any content, it sends this signed JSON to the "content service", which checks its validity by making use of the key "Account Service" sent earlier and thus authorizes the user and grants access.
I want to know a better/standardized way of doing this.