I think I agree, although I'd like to point out a few things. 1) Just like any other authentication/security system, probably not a good idea to write your own

I think I agree, although I'd like to point out a few things. 1) Just like any other authentication/security system, probably not a good idea to write your own for production. As a learning experience, definitely. 2) The spec is pretty good, although it's a little confusing that it's more or less split across https://tools.ietf.org/html/rfc6749 https://tools.ietf.org/html/rfc6749 (oauth) and https://tools.ietf.org/html/rfc6750 https://tools.ietf.org/html/rfc6750 (bearer tokens) 3) The hardest part about "getting it right" is that the spec allows for broken/insecure behavior. You don't have to enforce https; you don't have to use expiring token; you can even allow password-based grants. Making these choices would be stupid, but you'd technically be OAuth 2.0 compliant.