The place I work for deals with about 20 different site's oauth processes and it's amazing how widely varied they are. Some of them let you restrict the redirect_uri while others don't, some of them still need you to send a login/password pair for the first request rather than do an oauth flow, but then still use oauth-style tokens all over the place. A couple of them require that the token be passed as a query string parameter instead of as a header for all requests. Being responsibly secure with all of them is quite difficult. It doesn't help that it's very difficult to have a development environment work properly with them, so doing active work against them is often painful.

OAuth is basically a complete mess, implementation-wise, and that's really sad since it's such a promising and useful premise.