I'm looking at security methods for APIs. Using JWT access tokens after client login with user/password will work well for internal web apps using our own APIs. However, I'm looking at how we should secure our external APIs that other systems/clients may use to consume data.
I typically see API services providing a client_id and client_secret. This, however, ends up being used in OAuth2 which I'd rather not have to implement as I'm not confident of a successful, secure implementation of such a big spec and nor do I want to be dependent on auth0.
I think that if used simple JWT for external APIs consumed by applications then I'd have to have a different identity type than user/password. Such as an ID and secure key. What would be best?