OAuth 2.0 is so bloated that it scares people off. Something like the client credentials flow is relatively easy to implement on your own and is basically lets clients exchange a client_id (username) and secret (password) for an API key.

Bonus: If you stay close enough to the standard you can plugin a real OAuth 2.0 provider if/when you decide you need it.

> OAuth 2.0 is so bloated that it scares people off

I think we're thinking the same thought, maybe my terminology is sloppy.

Suppose we just say "Use this token-generation endpoint (with your credentials) to generate a session token, and attach that token by means of OAuth 2.0 Bearer Token in subsequent requests to other endpoints".

Doing that, we can easily scythe off any bloat, no? We don't care about people signing-in with their Google accounts, or anything like that. Or is that what 'client credentials flow' means?

So you need to get an access token by validating against a third-party (keycloak, auth0) to access your own API? That's a pain.

Just use a regular oauth server library in your language/framework of choice.

Third-party? Token-issuance is just another endpoint, no?