I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring).
I had a look at Kong and other oauth2 implementations but i get the feeling that this might be overpowered.
So i think a token-based RBA authentication should be fine for the beginning. The problem is, that this approach relies on expiration dates for tokens. But as i said - this is not what i want. So is it ok to have non-expiring tokens?
Also - what do you think? Is Oauth2 essential for my usecase? And how difficult would it be to later on migrate from a simple security concept (RBAC with access tokens) to Oauth2?