Simplicity on the the resource provider's end? So I implement separate IAM flows for my website, app and third party api access? Or... Make use of OAuth to st

Simplicity on the the resource provider's end? So I implement separate IAM flows for my website, app and third party api access? Or... Make use of OAuth to standardize it, using code auth+pkce for web/app, and client credentials (not user/pass, this is client id + secret, scoped to permissions you want) for third party APIs. The scoping is so useful, api keys tend to ignore that, so platforms like digital ocean only give you an all or nothing key, meaning I can't plumb an acme client in to do DNS challenges, without also letting it spool up a VM...