[ourcat]

Worth adding to this that Wordpress have been working on an official OAuth1.0a server plugin for while alongside the development of the new REST API. It works well. I've built an iOS app on the back of it. (1.0a was chosen due to WP not wanting to enforce https.) https://en-gb.wordpress.org/plugins/rest-api-oauth1/

I've also seen discussion on an official OAuth2 server plugin, what with the rapid increase of https sites, thanks to the likes of LetsEncrypt.

There's a well supported OAuth2.0 server plugin here: https://en-gb.wordpress.org/plugins/oauth2-provider/

But you'd be wise to only run it via https.

[machete143]

Yes indeed, running OAuth2 without https is madness!

[unilynx]

It's not just madness, TLS is a MUST in several places in the oauth2 spec.

In fact, they managed to remove a lot of oauth1 madness (all the complex signing stuff) by simply requiring TLS and let that layer deal with it.