But I get to refuse to turn OAuth into a cross-cutting concern in my application. You won't see refresh tokens referenced in the UI code. And I get to use a 3rd-party library that solves 90% of the pain for me.

I strongly disagree on the ratio. If you're building Mastodon client, most of your effort should be spent on features and UX, not on OAuth and the like. If half of your time is spent on those, either you're at the beginning of the project, or you're at the beginning of your career. Or maybe you just care about engineering itself more than the end product.

If you peek at that third party OAuth library, you will discover… it's complex. This is what I mean about pushing the complexity around on your plate. You can make it someone else's problem (and become dependent on them), but the complexity is still there. There is a minimum level of complexity that any OAuth system needs to have in order to function. QED

OAuth library is a perfect example of lousy engineers inventing complexity.

Here's a talk where Jack Diederich mentions it: https://youtu.be/o9pEzgHorH0?t=870

It is indeed complex: 200+ classes. Plenty of unit tests and mocks.

And then there's his implementation:

- 0% unit test coverage.

- Lightweight at less than 200 lines, including blanks and docstrings.

QED.