Part 3. API Gateway as an OAuth client