Unfortunately, my managed package needs the ability to enforce a limit that isn't a user license. Therefore, I need my managed package, installed in subscriber orgs, to ask my LMO (License Management Org) for permission to perform a specific action. This will undoubtedly involve the subscriber org making an HTTPS callout with its Org Id to my LMO.
My thinking is that I'd create a REST method in my LMO, along with an API Only user that had access to just this REST method and nothing else. The "credentials" for this API Only user would be stored in my managed package Apex code, and thus would not be accessible to subscribers of my package. I'd rather not store a user name/password/security token combo, so I'm thinking I'd use a refresh token.
I'm fairly certain OAuth, in general, is the answer here, but I'd like to nail down a specific implementation.