Microsoft, Yahoo (i.e. OATH) and others also use it, but it has limited adoption beyond the "big giants" of email. https://docs.microsoft.com/en-us/exchange/cl

Microsoft, Yahoo (i.e. OATH) and others also use it, but it has limited adoption beyond the "big giants" of email. https://docs.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth https://docs.microsoft.com/en-us/exchange/client-developer/l... In a way, server providers prefer it as (in theory) users' long term credentials don't end up stored locally in plain text. A revocable per application token is used instead, and they can trace that back to a specific application or developer registration. That it trains users it's ok to enter passwords in bespoke web views using abnormal or no clear URL view is a big issue though in my opinion - I've never liked flows that encourage entering passwords into web browsers you didn't open yourself, let alone ones provided by third party software, which can capture anything happening within the app itself.