No, it can indeed be vastly simpler to handle auth. But you have to consider many complex aspects to provide a simple solution: - What are your real use cases

No, it can indeed be vastly simpler to handle auth. But you have to consider many complex aspects to provide a simple solution: - What are your real use cases (authentication, authorization, delegation?) - What is your threat model? (avoiding silly mistakes, preventing corporate espionage, defending against targeted attacks require very very different solutions) - How to integrate into your ecosystem (tech stack, actors, layers..) Then you might be able to remove some constraints. You might not need authorization delegation, stateless and readable json tokens. But often it's easier to not think too much about it and just use "an industry proven standard", and that is oauth2 and OIDC: a large auth umbrella to avoid looking at the sun.