Ask HN: Securing two-party REST API access using tokens only

I've been reading tons of information on the web and still can't get a straightforward answer to what should be a very simple and common authorization scenario. Simply put, I just want to secure a REST API like how Github does it, i.e., you can create a revocable access token (with specific scopes) using the web application UI, and then use that token to make API calls. That's all I need; I don't need any 3rd-party client access or anything like that. So how do I create an OAuth server to achieve this? Or can JWT be used for this directly, so that OAuth not actually needed? Any pointers to readable online resources would be appreciated, since all my searches do not seem to turn up any results focused on the scenario I've described. I'd like to avoid using any proprietary solutions, but open source libraries are fine. Mostly I'd like to understand the fundamentals and terminology regarding how to implement something like this reasonably securely.