I feel the same way about OAuth2. It's very complex. It has it's business use cases, but if you don't need it (or don't need full-blown OAuth2) then don't use

I feel the same way about OAuth2. It's very complex. It has it's business use cases, but if you don't need it (or don't need full-blown OAuth2) then don't use it. If you're worried about the future separate auth user from account internally in your application (SSO ready) and move on. It sometimes feels like there's a cabal of people who think the more complex something is, the more skilled they are for being able to implement it. That's not really where the skill lies for an engineer.