Absolutely. You can just look at all the various revs and options that OAuth has and know that they are casting around for a correct answer. I've implemented

Absolutely. You can just look at all the various revs and options that OAuth has and know that they are casting around for a correct answer. I've implemented two oauth 1.x handshakes and both were full of one-off complications and incomprehensible error states. I'll take a look at OAuth 2 when it becomes more prevalent, but until then no why in hell I'm moving away from a simple "generate an API key" approach.