It looks to me like they only use OAuth2 (based on the authorize/token endpoints), they just oddly decided to version their OAuth2 api.