The benefit is decoupling the app server from the auth server. If all of the authorization privileges are tracked by the auth server, it becomes the single sour

The benefit is decoupling the app server from the auth server. If all of the authorization privileges are tracked by the auth server, it becomes the single source of truth. It also makes it easier to switch your app to a different auth server provider (or even accept auth from a list of different ones). If you have a whitelist of auth providers for your app, your users could all pick a different one, and you'd only have to implement a single auth protocol. You could even imagine allowing users to host their own auth server, and providing a way for them to register it with your app.