OAuth solves a real and hard problem: how do I let an application act on my behalf without giving it my password? The answer — a scoped, revocable token issued after I explicitly consent — is genuinely the right shape, and the API economy could not function safely without it. When you click “connect your account” and get a screen asking what the app may access, that is OAuth doing its job.
The difficulty comes from everything wrapped around it. Before a developer can get a token, they usually have to register an application, get a client ID and secret, configure redirect URIs, choose a grant type from a menu of options with unhelpful names, and implement a redirect dance — all before making a single call. For a developer that is a frustrating afternoon. For a non-developer who just wants to pull their own data, it is a wall.
The specification also carries genuine flaws and a long history of extensions, deprecated grants, and provider-specific interpretations, which means “we support OAuth 2.0” tells you much less than it should about what you are about to integrate with.
My position has been consistent for years: OAuth has many flaws and it is the best we have. Do not replace it. Do reduce the friction around it — offer personal access tokens for the common case of accessing your own account, document your grant types with working examples, and stop making people register an application to read one endpoint.
