I have a website that uses the SharePoint 2013 REST API to render list data (via JQuery AJAX) on the website. It is pretty straightforward and works fine, but my challenge is figuring out the security component. I was under the impression that the credentials of the Identity that is running the app pool for the website in IIS would be sent through to SharePoint via the REST API. It looks like this may not be the case and that it might be sending the credentials of the user logged into the computer - it's hard to tell. The goal would be to use a service account to facilitate the communication from the website to SharePoint via the REST API. Is there an IIS setting to do this? Do I have to use the client-side token on the API-call side or even use the cross-domain library?