One design dilemma we ran into when building this out is the "username" endpoint. When a user grants access, the OAuth default is to just pass the token back to the client. But to access other endpoints, the client needs to know the username of the user that just granted access.

So we added the "username" endpoint, but weren't (and still aren't) quite satisfied with that as a solution. Have other API designers run into this same issue? Seems pretty common - would like to hear what HN has to say about it.