I think that works great! The complaint I’ve heard is that you may need to support multiple ways to authenticate opening up more attack surface.