We use encrypted JWT tokens. I'm not sure it was the best choice, but it was the simplest for our needs. Basically the developer is responsible for generating

We use encrypted JWT tokens. I'm not sure it was the best choice, but it was the simplest for our needs. Basically the developer is responsible for generating & distributing auth tokens for each device that they want to use our service. This service is designed to fit into games and AR apps, so we didn't want to force our own oauth flow on the end user. This way, the developer can generate a token on behalf of the end user, and distribute it how they see fit. (assuming one token per user, but it don;t overly matter, it's still tied to their account.)