After investigating possible ways to improve auth performance, it was determined that caching tokens in OKAPI is worthwhile.
Some details are still TBD, e.g. whether the cache should be cluster-aware, if the ability to explicitly purge the cache is needed, default TTL, how is this configurable? At runtime? via command line args? etc.