Explainers: OAuth
DPoP vs Bearer Tokens: What Proof of Possession Changes
How DPoP binds OAuth tokens to a client key, what replay checks add and which risks still remain.
OAuth vs API Keys: Choosing an API Authentication Method
OAuth and API keys identify different actors. Here is how to choose by principal, scope, lifetime and revocation.