I wrote an article for the Nordic APIs website about strategies for integrating OAuth with API gateways. If you want to learn when to use the Phantom Token approach, when to use the  Split Token approach, and why you should always use at least one of them, then look here: https://nordicapis.com/strategies-for-integrating-oauth-with-api-gateways/.