Everything you've said is true for web authentication, and almost nothing of what you said is true for HTTP authentication.

This is HTTP authentication: https://httpd.apache.org/docs/2.4/mod/mod_auth_basic.html

https://github.com/francoismichel/ssh3/blob/5b4b242db02a5cfb...

https://www.iana.org/assignments/http-authschemes/http-auths...

Note the OAuth listed there is OAuth 1.0. Support for "native" HTTP authentication was removed in OAuth 2.0.

This discussion is about using HTTP authentication. I specifically said HTTP authentication in the root post. If you want to do SSH + web authentication, that's a different thread.

Rule of thumb: if you need HTML in any step of it —and that includes as part of generating a token— it's web auth, not HTTP.