Xrm api is accessible via client credentials without any special setup (be it on-prem or on-line) - you just setup S2S user with appropriate permissions, and you can log him in like:
static void InContext(Action<IOrganizationService> callback, Org org)
{
    var credentials = new ClientCredentials();
    if (!org.IsLocal)
    {
        credentials.UserName.UserName = org.UserName;
        credentials.UserName.Password = org.Password;
    }
    else
    {
        credentials.Windows.ClientCredential = new NetworkCredential(org.UserName, org.Password);
    }
    using (var serviceProxy =
                new OrganizationServiceProxy(new Uri(org.OrganizationServiceUri),
                    null, credentials
                    , null))
    {
            callback.Invoke(serviceProxy);
    }
}
public class Org
{
    public string UserName { get; set; }
    public string Password { get; set; }
    public string OrganizationServiceUri { get; set; }
    public bool IsLocal { get; set; }
    public Org()
    {
    }
    public Org(bool isLocal, string userName, string password, string organizationServiceUri)
    {
        IsLocal = isLocal;
        UserName = userName;
        Password = password;
        OrganizationServiceUri = organizationServiceUri;
        DiscoveryServiceUri = discoveryServiceUri;
    }
}
And then in your backend code:
var org = new Org(true, "Administrator", "Password", 
  "http://ondracrm/org/XRMServices/2011/Organization.svc");
 InContext((os) => {
   // some sample work with organization service
   var response = (RetrieveEntityResponse)os.Execute(
      new RetrieveEntityRequest 
      { 
        LogicalName = "contact", 
        EntityFilters = EntityFilters.Attributes 
      });
 }, org);