Hacker News Reader

For an overview, you might like these two articles:

https://www.lvh.io/posts/a-childs-garden-of-inter-service-au...

https://fly.io/blog/api-tokens-a-tedious-survey/

To be honest, my first instinct was to give a hand wavy "use OAuth". But to elaborate a but further, oauth is made for this and is the industry standard for this kind of thing. There's lots out there on oauth that tells you more than "just use it", it's just a couple searches away. So I don't think I really understand the question.

Disclosure: I work for FusionAuth.

Have you looked at the specific RFC for token exchange? https://datatracker.ietf.org/doc/html/rfc8693

The concepts are solid, even if not every vendor supports it. FusionAuth doesn't, though we have an open issue for it: https://github.com/FusionAuth/fusionauth-issues/issues/1471

Use OAuth?