OAuth servers typically combine authentication, profile management, and delegated authorization in one component. This case study describes a production architecture where the Authorization Server stores nothing about users beyond the identity asserted by an external IdP.
The system was shaped by three hard constraints. Hundreds of isolated APIs are created at runtime, each becoming its own audience. The client is a public SPA without a backend-for-frontend, so bearer tokens cannot be hidden from JavaScript. Resource servers must validate tokens locally because synchronous calls to a central AS would create unacceptable latency and a single point of failure.
The Authorization Server therefore knows only the IdP identity (provider and profileId) stored in short-lived Redis sessions. It issues short-lived access tokens and refresh tokens containing standard claims plus application claims for audience and tenant. The sub claim initially holds the federated identity; after the Main API registers or links the user, the same claim is replaced by an internal UUID together with profile claims.
Profile data lives exclusively in the Main API. This separation reduces blast radius: compromise of the AS yields no personal data, while compromise of the profile database leaves authentication untouched. The AS remains a pure issuer that can be rewritten or replaced without touching product logic.
Tokens never reside in localStorage or page memory. A Service Worker holds them in its isolated context, automatically attaches the Authorization header, and performs refresh centrally for all tabs. After login the SPA immediately revokes the first access token; the worker later obtains a fresh token via a custom FedCM grant that re-uses the existing session cookie.
The architecture also satisfies data-protection requirements by keeping personal data out of the central authority. Deletion requests are handled locally by each resource that stores a profile, eliminating the need to search the entire system for copies.
