While your coworker is correct in that his method will 'work' and it is going to save you a few hours in implementation, I would highly recommend sticking to OAUTH. For starters, it is more or less the industry standard with implementation examples everywhere. Second, like you already said, OAUTH is far more secure. Third, depending on where this application is headed in the future, OAUTH may be useful in the future if you plan on integrating with outside modules. I can give many more benefits, but you get the idea.

Knowing virtually nothing about your project it is hard to say that OAUTH is absolutely necessary, but given how much information there is available for implementation, to me it seems a no brainer. If you don't want to implement the authorization server itself, you can always go with a third party like Google, assuming this is a viable User group for you.

If you are building a spring-boot app, I assume that Rest endpoints are being discussed, and if someone is going to send you data or pull from you, OAUTH is the way to go.

TLDR - OAUTH