You are right, OAuth2 is overkill in this specific case and despite the comments, it will add unnecessary complexity to the whole project. That being said, remember that OAuth2 is not an authentication protocol, so one more reason to leave it aside for now. Anyways, take a look to this article and get your own conclusions and decide if it's suitable for you.
The OAuth2 main goal is authorising different application providers to share data without the need to share the credentials too. I assume that it's not your case (yet).
I authorise Instagram to publish my photos on my Facebook's wall. And I authorise Facebook to share my data and my contacts with Instagram.
That's it. However, many developments out there implement OAuth2 as dedicated security servers (authorization and authentication). That's neither right nor wrong. It's just the solution that best serves their needs.
You never should implement something just because everyone else does it1. If you do, it's likely you will end up with an unsuitable solution. In security one of the most important concerns is suitability. Unsuitable security precautions may result in unexpected security holes.
The problems with basic authentications (among others) are two:
Browsers store basic authentication headers in order to don't ask you the credentials over and over. That doesn't happen with asynchronous calls (Ajax), in consequence, we have to store the credentials somewhere on the client-side. That leads us to the LocalStorage and cookies, both sensible to XSS attacks.
This vulnerability is going to be present no matter what we store, however, If we had to choose, we should choose to expose a well-encrypted token, and this's not the case of the basic authentication.
While the first (encrypted tokens) may or may not make my account vulnerable, the second (base 64 encoded credentials) is totally giving away the keys of the home.
So what do? Due to you still have to implement a login process and you still need a solid token-based mechanism for authentication and authorization, JWT is probably your best choice.
It's simple, it's well documented and it's broadly supported by the community. And overall, it's suitable.
At this point, you might be interested in OWASP REST Security Cheat Sheet. Security is all about awareness and suitable precautions.2
Note: OAuth2 and JWT are not mutually exclusive. We can combine both. Finally, the security threats are different for web applications and for mobile applications and therefore the respective security measures. That's why suitability is important.
1: This doesn't mean that you have to re-invent the wheel. Hell no! Use OAuth2 when you need OAuth2. That's it
2: Whether you implement OAuth2 or JWT, SSL is a must