The main problem with OAuth is it's a three party system.

You have an API provider service, an API client service, an a human telling the provider that the client should be allowed to access a limited subset of data on the provider service.

That's fine in cases where you actually need three parties involved, e.g. an API that allows access to a user's photo library stored in the cloud... but that's not every situation and if you can avoid it, you should.

A simple two party system, where the API provider authorises the API client, is vastly simpler. And just as secure (more secure even, because complexity is the enemy of security).