New API path for external application authentication