Eh, I don't really mind a service playing in the same space as Keycloak.

It's really not much work to spin up a service, and personally having used Rails + Devise + OmniAuth + Doorkeeper... I'd pick Keycloak instead.

The level of complexity is pretty similar at the end of the day, but you get more robust auth service, with a lot more flexibility.