When the Caller Can’t Do OAuth2: HMAC as the Secure Way Forward

The real-world problem