NewTech··9 min
OAuth Is Not a Login System. And as of 2.1 There Is Only One Flow.
Two things would prevent most OAuth bugs. OAuth answers what a caller may access, not who they are, so using it to log people in is a category error. And the flow chart everyone agonised over has collapsed: authorization code plus PKCE, for every client type, no exceptions.
oauthoidcauthentication