I created a course about building an Identity Architecture for APIs. You can learn about token flows, proof-of-possession tokens, scopes and claims, token-sharing techniques, and more. The course is free, though you have to register: https://curity.io/resources/webinars/course-building-identity-architecture/ It's even been featured in the APISecurity.io newsletter!