Putting OAuth authentication on an oEmbed endpoints strikes me as counterproductive.