Our old authentication system logged users in with the OAuth2 client_credentials grant.
If you know OAuth, you just winced. client_credentials exists so that a client application can obtain a token for itself, rather than on behalf of a user. It has no concept of a human being at all. But it takes two values, an ID and a secret, and if you squint, an email address and a password are also two values.
So that's what it did. Each user effectively became an OAuth client: client_id was their email address, and the registered client secret was their BCrypt password hash. The browser sent an HTTP Basic header, the server matched the credentials against that per-user registered client, and out came a token.
It worked for years. That is the recurring theme of this post.
What we actually had
