Why is OAuth still hard in 2023?
On point 1, that's why <a href="https://oauth.net/2.1/" rel="nofollow">https://oauth.net/2.1/</a> is in the works, to make a smaller, clearer subset of things that folks need to read and implement