We have a private Ethereum network running in our testbed. And a web3j-based (Java) API exposes various functionalities to the deployed smart contracts on the blockchain. The API connects to the blockchain using its own Ethereum identity/credentials.

A frontend application (under development) will be interacting with the blockchain via the web3j-based API. We might also use Metamask for user wallet management at the frontend app.

Our current concern is that all the transactions currently fired to the Ethereum blockchain are sent using the API's identity (msg.sender or tx.origin within the smart contracts). Is there a way where the end user doesn't have to pass on their credentials to the API but just authenticate/authorize/sign the transactions and the API can submit the transactions on the user's behalf to the Ethereum blockchain?

We're very new in this direction and appreciate any help.
Thank you in advance!