I have to implement a separate authentication server using OAuth.

The tech-stack that I am using is django and graphQL.

As I am maintaining a separate server for authentication, I have created two django projects that run on two different ports, one for the authentication and the other as a resource server to perform CRUD operations on the user model.

But since I have to authenticate the user using username and password and should issue access tokens, should I define the ‘user’ model in the project module which is dedicated for the authentication server?

But if I am creating the ‘user’ model on the authentication server side, every time when the user requests for some information, my resource server needs to make a request to the authentication server to get that information. Is this a common practice?

I have tried creating views in my authentication server, as in ‘/register’ and ‘/verifytoken’. The resource server will place POST requests to these views using graphQL while registering the user and also while trying to access aa protecrted resource to verify the access token.

But since I am using /register and /verifytoken routes, does it come under using REST API?
If yes, how do I use graphQL on the authentication server side?

I wanna establish this scenario using graphQL for API calls ROPC OAuth Flow