Securing APIs with OpenID Connect