The OAuth 2.1 and OpenID Connect authorization server for applications of the catalog: their clients, the authorizations and tokens it issues, kept as hashes, and its rotating signing keys