OpenAPI using OAuth-2.0-like protocol