It's probably just a typo, but OAuth(2) is exactly NOT an authentication protocol: https://oauth.net/articles/authentication/