No status code system is ever perfect or you wouldn’t get the benefit of the status codes. I feel like this problem is solved higher up by doing exactly what you say via OAuth, etc.