I would like to implement an authentication between two parties (for example a user and a bank) but I stumbled upon a "design/implementation" doubt. I need to do this steps:

1. user to communicate his address [something related to my project] encrypted with bank's public key
2. bank decrypt address and send to that address some data (for authentication purpouses) encrypted with user public key
3. user decrypt and use digital signature to sign that data and send it back (like before and blablabla)

I've created the server [with nodejs->express] which provides endpoints for:

• registration of users/banks [or other requesters of authentication]
• encryption with pub key
• decryption with private key sent as a parameter
• digital signature

The question is:

Now, are banks that needs to call with the right sequence my endpoints to authenticate users or should I create a new Endpoint like /authenticate and in some way automatically retrieve the user+bank requests to my endpoints? The first option seems more like an api service but I don't know if it's the only way to do it. And for the second one i have no idea how to do it.

(Sorry for my bad english I'm Italian, I do only know pizza pasta peperoni language)