Yes they are standard, but this is akin to having a 'standard menu' at a restaurant. You're not getting every item on the menu, and for the ones that you do you

Yes they are standard, but this is akin to having a 'standard menu' at a restaurant. You're not getting every item on the menu, and for the ones that you do you could make modifications. OAuth2 and OpenID has many standards documents. A 'standard' OAuth2 server can be written in 30 minutes if you only care about 1 grant type and none of the extra features and 1 flavor. But it can also take 6 months if you do want support for all the features such as introspection, revokating, multiple grant types, ID Tokens, etc. I wrote a bit about this issue here: https://evertpot.com/oauth2-usability/ https://evertpot.com/oauth2-usability/ Note that this post is only about OAuth2, adding OpenID to the mix blows this problem up further. The key point is that OAuth2 and OpenID provide a framework for building authentication and identity systems, with a matrix of possible implementation details that often have to be communicated out-of-band. It's still useful as a foundation, but picking an OAuth2 implementation is not as simple as just finding one that is OAuth2 compliant, you might have to dig deep and find out what parts you need and if your server implements them.