I'm trying to get into Microservices by creating a project, so far I've stumbled upon authentication mechanisms, in a monolithic architecture, the client (web app) would send a request with the user credentials to receive a JWT and send it in every upcoming request. However, when it comes to Microservices I found out that there were two different ways to achieve the same, stateless authentication mechanism, either by delegating the authentication and authorization responsibilities to the gateway service, or by using OAuth2 (or OpenID Connect??). Most online resources recommend OAuth2, however isn't it used for service-to-service authorization? Should I use the authorization code flow with password grant?
The API is only going to be accessed by a single client (web app), so no other service is going to ask the user for their data consent or something.