But this would reduce the ease of use of the API, increase the latency because of round-trip and will not provide a better security. The fit is not very good.

oauth is a good standard when used for the correct use case, which is not the case for this. Sometime a simple solution is better than a framework