add OAuth flow, add public key to GET /tenants response