Authorization is derived from authentication; authentication is the core concept underpinning security, while authorization is about defining the scope of the a

Authorization is derived from authentication; authentication is the core concept underpinning security, while authorization is about defining the scope of the access. Restricting the scope is mostly useful for when you need to interact with services that talk to other underlying services without granting them full access to those, but in practice, that's not a very common case outside of the web. Ultimately that distinction doesn't really matter, what's important at the end of the day is how you implement the access control. Using an opaque token and an introspection endpoint is a terrible idea. JWT is a good solution. All of the OAuth flows do is just provide convoluted ways for the user to authenticate with a identity provider, generating a JWT on his behalf, and do not contribute to security in any meaningful way.