No one implements it the same way. Some require scopes, some don't. Some require comma-separated scopes, some want an array. Some require an HMAC signature,

No one implements it the same way. Some require scopes, some don't. Some require comma-separated scopes, some want an array. Some require an HMAC signature, some don't. Some want a JSON body, some want a urlencoded form. Etc. Etc. Etc. You're never implementing OAuth, you're implementing some company's bastardized flavor.