Oauth, even oauth2, seems like a classic open, design-by-loose-committee failure. Too many options and open ended decisions.

My hope is that now that the basecamp2 API supports it, their implementation will become the reference standard.