How would you design access control for externally hosted web apps?

Worked on a similar setup last year for a small SaaS marketplace. The cleanest pattern is signed JWTs issued by your marketplace, with each developer app validating them against your public key. No DB lookup per request, no shared secret to leak, and you can rotate keys without breaking anyone.

Flow looks like this. User logs into the marketplace, you mint a short-lived JWT (15-30 min) with claims like user_id, app_id, subscription_status, expires_at. The token gets passed to the developer app via redirect or header. The dev app verifies the signature using your published JWKS endpoint, exactly like Auth0 or Clerk do it. If you need real-time revocation when someone cancels, add a lightweight introspection endpoint the app can hit, or push webhooks on subscription changes so the app caches state locally.

The thing most marketplaces get wrong is letting developers handle auth themselves. Forces them to integrate Stripe webhooks, manage their own session logic, deal with refund edge cases. Your marketplace should be the source of truth for "is this user paid", and the dev app just trusts your token. Saves devs a week of work each and you keep control of the billing layer.

If the apps are deeply integrated and you want per-feature access control, OAuth 2.1 with scopes works well. Marketplace acts as the auth server, each dev app is a resource server. Slightly more setup but standard tooling everywhere.

Are these developer apps web-only or do some run as APIs/agents too? Architecture changes a bit if you need machine-to-machine auth on top of user sessions.