In my company, we are working on a monolithic application composed of several elements:

• Frontend: user interface,
• Backend: AJAX request management and server-side form validation,
• Task daemon: recurring process that runs at regular intervals.
  Recently, I developed a REST API to centralize certain functionalities, enabling our customers to access them via external scripts.

We now want to evolve our application so that it gradually consumes this REST API. However, I’m faced with an authentication problem: I don’t know what method to adopt to allow our application to access the API.

Currently:

The REST API uses manually generated API keys, as access is restricted to specific users.
The application, on the other hand, uses PHP sessions to manage authentication.

Here are my questions:

• Should I generate API keys for all our users to enable API access from the frontend?
• Would it make more sense to set up a specific authentication method for the frontend of our application, separate from the current API keys?

Below is a simplified diagram of our architecture:

I’m a bit lost on this subject and would welcome any suggestions or feedback. Thanks in advance for your help.