Why is OAuth still hard in 2023?
Because the documentation is bad.  Oauth is really simple:<p>Lets say you want to use google as an auth provider.  You do this:<p>&quot;Hey google who is this guy?  I&#x27;m going to send them to google.com&#x2F;oauth, send them back to example.com&#x2F;oauth, and in the headers of the request include the word &quot;Authorization: bearer&quot; followed by a bunch of text&quot;<p>Google says &quot;Oh yeah I know that guy, here I&#x27;ll send them back to where you said with a token&quot;<p>Then later on you can take the token and say &quot;Hey google, somebody gave me this token, who is it?&quot;<p>That&#x27;s <i>pretty much it</i>.  You have to trust that google isn&#x27;t lying to you, but that&#x27;s kindof the point of oauth.<p>But that&#x27;s never what the documentation says.  It&#x27;s always 10 pages long and the examples are like &quot;here&#x27;s a fully functioning python web server using flask and function decorators, oh the actual auth flow, which is really like 3 lines of code, is hidden inside of a library&quot;.<p>To people who write documentation: PLEASE for the love of god show me how to talk to your API both using your library, but <i>also</i> using something like urllib2 or requests or something.<p>Ideally the documentation is the absolute most minimal way of making the service work, and then adds more and more usefulness on top of that.  I&#x27;m not going to judge you for writing bad code <i>in an example</i>.  The example could practically be pseudocode for all I care.  I just want to see <i>generally</i> how your API is supposed to work.<p>edit: yes, auth0, I <i>am</i> looking at you.