Hacker News Reader

You're free to handle a billion qps in authentication requests if you want. I don't suggest it.

Greatly reducing hosting costs at the expense of making someone else do a little more work sounds like a win to me.

Don't the clients have to do a billion qps as their retrieve access/refresh tokens from their data stores?

Yeah, but it's a negligible rounding error of cpu time for each client.

Distributing this work ironically makes it much easier to centralize the authentication.