The IndieWeb[0] community has come up with a protocol called AutoAuth[1]
that solves this exact problem.
It's only a rough draft at the moment and it is built upon the IndieAuth[2]
protocol (which, in turn, is based on OAuth 2), but I think the way it works is highly fascinating.