I don't think there's any reason to draw such a hard distinction between API keys and OAuth2 tokens. Either can be a subset of the other. In a well-designed OA

I don't think there's any reason to draw such a hard distinction between API keys and OAuth2 tokens. Either can be a subset of the other. In a well-designed OAuth2 flow, the user should be able to select fine-grained permissions if they want to. You should be offering that same level of control for API keys. I don't see why they can't share almost all the same infrastructure. The main different is the API calls needed for OAuth2, but it's a huge value add. You can still let people generate keys if they want to, but a well-implemented OAuth2 deployment is superior even in headless cases. Rather than having to click through the dashboard generating and copypasting keys, I can enter a short OAuth2 code in the CLI and be off to the races. Plus you get all the security benefits of token rotation, etc.