Comment by geal

oh and for OAuth, it can integrate well with it: https://www.biscuitsec.org/blog/oauth-oidc/