I have a number of custom app server endpoints that I want to protect with an oauth id token. In concept, the user would login through, say, Google Auth. Then this id (or access) token would be sent in a header when calling my endpoints. I can't quite figure out how to do this as it looks like everything is resource-based and it's not really desirable to have to authenticate individually with 10 different endpoints. In summary:
User logs into Retool app through OAuth2 workflow.
This generates an id token that is available to resources.
I add this token to each of my REST requests.