Code Igniter - Consuming my own API and authorisation - php

Question

I am attempting to build my HMVC codeigniter install into an API centric HMVC (yeah I know!)
I have ion_auth as the authorisation system at the moment.
The way I have it set-up is
MODELS
CONTROLLERS
- API CONTROLLER
- CONTROLLER
VIEWS
With the API controller accepting JSON encoded inputs and sending JSON encoded outputs.
Now - it all works fine -> I can access the API by calling controller/api and can pass it JSON and receive JSON back.
I then just call the controller/api from within my normal controller
My problem now comes with authorisation.
Nobody can access the API if they aren't logged in through Ion_auth (so it is secure) BUT
How do I then expose the API?
I presume I need to go down the O Auth route but I have tied myself in a knot trying to get my head around how I can use O Auth for the API and not impact the performance of my application when accessed via my controller.
It is down to not understanding how O Auth works fully (I can implement it and understand the hand-shakes etc. but the nitty gritty) -> if I found some way of authenticating a user via O Auth (I mean a site user not an API user) how does this carry through to my controllers - is it stored in a session? Can I give my controllers Authorisations? (Do I need to)
OR - is there a way of doing this with Ion Auth that I haven't heard about?
FOR CLARITY
I want my own application to be able to use it's own API, but do not know how to set up the authrosiation so the API can be consumed directly as well as locally by the application itself (when users are using the site)
HELP!!!!
Thanks in advance!

Answer 1

Maybe you can remove O auth for the API and just create a table of access key. When someone calls the API he needs a key that registered in the table. No ?

Answer 2

Using Promo's answer, plus a little thought after he pointed out the obvious all I did was this:
public function __construct()
{
parent::__construct();
//see if they logged in -> if they are no problem as they are obviously using the page through my application, if they aren't then we do checks for the API
if (!$this->authentication->logged_in())
{
$this->token = $this->input->get_post('token');
//API should have a token set before anything can happen, this is for every request
if($this->token){
//Check that the token is valid
if (!$this->checkToken($this->token)){
$this->error('Token did not match');
}
//all clear if we get to here - token matched
}else{ //no token was found
$this->error('No Token was sent');
}
}
}