Germany Built the API Authorization Blueprint the Rest of Government Needs

Every government I have ever looked at has the same quiet problem hiding under its digital-government ambitions: it has no shared answer for how one public-sector system is allowed to call another one’s API. Each base service — a citizen mailbox, a register, a payments hub, a once-only data exchange — grows its own bespoke way of authorizing the systems that consume it, its own registration process, its own secret-handling, its own idea of what a “scope” means. Multiply that by every agency and every state and you get exactly what you would expect: duplicated cost, inconsistent security, and a