Seeking Advice - Unconventional JWT Authentication Approach

Hi all,

We’re building a 3rd party API and need authentication. The initial plan was standard OAuth 2.0 (client ID + secret + auth endpoint to issue JWTs).

However, a colleague suggested skipping the auth endpoint to reduce the api load we are going to get from 3rd parties. Instead, clients would generate and sign JWTs using their secret. On our side, we’d validate these JWTs since we store the same secret in our DB. This avoids handling auth requests but feels unconventional.

My concerns:

• Security: Is this approach secure?
• Standards: Would this confuse developers used to typical flows?
• Long-term risks: Secrets management, validation, etc.?

Does this approach make sense? Any feedback, suggestions, or red flags?

Thanks!