Proprietary techniques like this are usually a good indication you’re missing something. In this case it sounds like you are missing appropriate validation of the issuer and/or token itself.
To make it universal, I had to keep complexity minimal and focus on the most supported protocol which is plain OAuth2.