https://blog.axway.com/apis/understand-your-api-security-need-oauth-or-openid-connect