>" Stuff like "API Clients need bearer tokens" is completely backwards and pushed by marketing people from companies (Auth0, Okta, ...) that misuse open protocols (OAuth2, OIDC) as a way to legitimize the closed source saas approach they took."

Can you elaborate on how they "misuse" them? I don't have any familiarity with those two companies, generally curious. Thanks.