When writing HAL to allow web calls into Standard ERP, which are not using the standard REST API, is it possible to call the same OAuth code which asks for the Standard ID and password? Or, to authenticate against a username and password added to a custom block, specifically for this purpose?

The example would be a third party system which makes a web call into Standard ERP, either to POST or GET information. Currently the security is a bit weak. It is of course possible to restrict the web request to a specific IP address but some kind of authentication would provide an additional layer of security.