I don’t really disagree with your statements, but I’d like to point out that: 1. Just because a large company does something does not make that thing safe or c

I don’t really disagree with your statements, but I’d like to point out that: 1. Just because a large company does something does not make that thing safe or correct—especially when your risk appetite and attack surfaces are not the same. 2. OAuth has it’s place, but it alone isn’t enough to secure an API. With or without OAuth most applications need well defined identity management, authorization mechanisms (distinct from authentication mechanisms), and all the other pesky implementation details one needs to consider when there is a desire to guarantee the authenticity, integrity, and/or confidentiality of requests to and from said application.