When a user logs in, auth is a solved-feeling problem: they type a password, you check it, you hand them a session. But inside a system of microservices, most traffic has no user at all. The billing service calls the accounts service. A scanner calls the reporting API. There's no human, no password to type, and yet the callee still needs to answer one question before it does anything: is the thing calling me actually who it claims to be, and is it allowed to ask this?

I built the internal service-to-service auth for a platform from scratch, using OAuth2 client-credentials with Keycloak and OIDC. The mechanism is genuinely simple once it clicks. What took the time, and what this post is really about, is the handful of validation details that are quietly load-bearing, the ones where getting it 90% right means you have no security at all.…