Hey, I have a question towards OAuth integration with SpiceDB. We have multiple services which need to interact with SpiceDB to update, read relationships etc. How can we authorize these services? From the docs I found "Restricted API Access" https://authzed.com/docs/authzed/concepts/restricted-api-access But here it seems that it only supports its own internal user system. Are there any examples or references out there how this could integrate with another OAuth IDP?

as in they're services with service accounts?

They are services with "service accounts" in the OAuth ecosystem, meaning they have client credentials to retrieve a JWT for themselves for federated auth. In my current thinking there would not be another service involved, ideally SpiceDB would handle the authorization based on the presented JWT

okay, then yeah, they'd be subjects like any other within SpiceDB, and you'd either need to use the

Restricted API Access

feature of our paid platform or write an equivalent wrapping service yourself.

Yes, we are considering using the paid platform. The Restricted API Access only covers the build-in service accounts, is that correct? Any OAuth integration for service account auth would need to be integrated outside/in front of SpiceDB?

correct - anything that's coming in dynamically through oauth would need to be covered by a fronting service

apologize, I've been out during a workshop. access for these accounts would ideally be provisioned on-the-fly to support onboarding new applications. it is infra-level primarily, to enable applications to query relations. alright, then we'll consider if such a fronting service is something we are able to maintain thanks!