[Design] Suggest an authorization API flow.