This was another great opportunity to pull in something to handle the token expirations and how to authorize the user rather than trying to also build this part yourself. Rather than focusing on the core product, a lot of time is wasted building application adjacent architecture. Worse still, an authZ system requires security expertise and lots of teams lack that. So while it can be easy to get started, vulnerabilities and necessary requirements will continue to build.

ScaledAccess, Oso, and Authress are the notable solutions here.