About Basic Auth vs Oauth @stefan.van.den.oord and @dharrigan I worked at a local payments provider in Brazil, similar to Stripe (we inspired a lot in their APIs) and we also just choose basic auth for authentication. We never experienced any issue in two years of operation.

But there we were a focused team with a very strong DevOps practice. In the current company I work, there is an info security staff that never would approve such approach

I would rather stay away from Keycloak. It depends on your setup. But because they use the database to sync things, combined with a 'slow' database, it was quickly failing in our case.