Application-key support for REST-API

[kofemann]

In some workflows, the clients of the REST interface are not users, but some other systems. fr such systems, short-lived tokens or username+password combinations are not practical. Thus, an application key with associated permissions/restrictions can be more practical.

[nManger]

As far as oauth tokens are concerned, this actually has a solution within the oauth2 standard: The client credentials grant.
In this grant type, the provider issues you a client-id and a client-secret (which can be as complex as needed, similar to an application key). The "client" system can then ask the provider for tokens as needed and authenticate with dCache as usual.