I think you can log into https://customer.website.com form and request a token with the provided data to https://api.website.com, if the request success then you save the returned token and log into the customer system (maybe saved the token in cache?).
I don't understand if you will use api.website only for login or for login and get/post data. If is only for login then you are done, just remember to expire the token when user logout or after certain time.
If you will use it for login and get/post data after login when you need to request any data, you make a request from customer.website backend to api.website request adding an authorization header with the saved token. This last will be a little slow because it uses two requests to solve authorized requests but it will works.