I need to validate it against an external User store.

Just so you know, all users in Liferay must be real Liferay users. You can't auth a user in a 3rd party system and not have them exist as a Liferay user. So first thing you need to do is figure out how to handle user import into Liferay.


For authentication, take a look at the Token Based Authentication support already part of Liferay. It can use a cookie or a header for authentication purposes, but not a param. Params are not normally part of an incoming request because those are typically tied to the method being invoked, so these are two separate concerns.


You could, of course, completely fake it. Make the API a guest API so no authentication to invoke at all. Then your token can be part of the request because internally you'd need to complete your external auth lookup. From Liferay's perspective though, all of this would be guest access so no way to audit or anything using typical Liferay mechanisms.