This was my experience as well. I've previously blindly followed instructions from OAuth libraries, but it frustrated me that I didn't fully understand what was going on.