API key and server to sever communication in Headless scenarios?

[hung-doan]

The current OrchardCore support OAUTH2/OpenIdconnect provider, which is really good for user-server authentication.

However, in case of server to server communication in a Headless CMS. Say my CMS is totally isolated from the public users, all requests need to pass though my middleware like this:

Users                                        <--(1)--> My App/Service  <--(2)--> My CMS
My background service                                                  <--(3)--> My CMS

We can see that at (2) and (3), there are server to server communication where the OAUTH2 token is a bit complex for this scenarios ?.
It's complex because we have to issues tokens, monitor and refresh them when they are going to expire or when the signing key on the server has changed,...
In this case of project It seems a basic traditional API key is good enough ?

Is there any better alternative for server-server communication via HTTP(s) ?.