I have a Lighting Out App hosted on a website and have been using this for read-only actions for sometime via an unauthenticated Community endpoint. This has worked out well. I now have a requirement to provide some functionality form the Lighting Out which an authenticated user I thought would be able to perform. To try this out in a POC I've created a Connected App and authenticated via oAuth to my SFDC sandbox to obtain a token which I now provide in my Lighting out Markup. On performing actions from the Lightning Out App on my website I note it's still running as the Site Guest User. I changed the URL from the community endpoint to a Sites endpoint and it has not made any difference. Should an authenticated Lighting Out session not run as the authenticated user? I thought I'd clarify if my understanding of it has been correct.
Thanks in advance for any help on this. It may be an error on my side in terms of my token but thought I'd confirm if the concept is correct.