How can we pass access token from clients to ejabberd so that ejabberd can make use of it to call http REST api?

Question

I don't want to have ejabberd use its internal database for storing user info, instead it should make http API calls to get user info whenever it requires using ejabberd mod_roster module. But for this ejabberd would require access token, which has to be passed from client to ejabberd. How can client send such info, and how will ejabberd reacts to after getting such info? Which module of ejabberd would require modf to make use of access token?

Answer 1

You can pass it in some initialization flow in new iq stanza and custom module subscribed to it. The new mod would store it in some db.

But is it the right way to go? server is the trusted party, also users are registered on server, so it should be able to call your API without any more info.