Can anyone 'point the way' for this case we are working on? We have a bunch of separate applications, and users login to each one with Ory Open ID Connect. In most cases, users in an application create content within the application and that's that. But some content is allowed to be read by all users, as long as they have an account with access on one of the sites. Example Application A, user Joe wants to read shared data from Application B but Joe does not have an account. What 'should' we be using to secure access to allow Joe to read from Application B if we don't want to give her an account on Application B? Some partial answers - We can set up clients and use the client-credentials flow to get tokens Oathkeeper to validate access - just use the Ory endpoint when configuring this: https://www.ory.sh/docs/oathkeeper/pipeline/authn#oauth2_client_credentials #wordpress