`docs/` is entirely OAuth 1.0a content inherited from WP-API/OAuth1, and describes a different plugin:
- `docs/introduction/OAuth-1.md` argues against using OAuth 2
- `docs/basics/Signing.md` documents HMAC-SHA1 request signing, a concept that doesn't exist in OAuth 2
- `docs/introduction/Setup.md` tells the reader to clone the OAuth1 repo
- `docs/spec.md` is an orphaned OAuth 1.0a spec, not even linked from the table of contents
None of it documents this plugin's actual surface: the two endpoints, the grants (authorization_code, implicit, client_credentials, personal access tokens), PKCE (#1), the `oauth2.*` filters, or the known deviations from RFC 6749/7636 (see #3, #4, #5, #6) that integrators should know about.
`docs/advanced/Desktop.md` is worth calling out specifically — it's precisely the PKCE use case (native/mobile clients) and currently describes the flow without mentioning it.
Also while touching docs: `README.md` says "WordPress >= 4.8" against CI's 6.5 floor, `bin/readme.txt` says "Tested up to: 4.8", and `book.json` points at a legacy GitBook toolchain nothing in the repo can actually build (no `package.json`, no CI step for it).
`docs/` is entirely OAuth 1.0a content inherited from WP-API/OAuth1, and describes a different plugin:
None of it documents this plugin's actual surface: the two endpoints, the grants (authorization_code, implicit, client_credentials, personal access tokens), PKCE (#1), the `oauth2.*` filters, or the known deviations from RFC 6749/7636 (see #3, #4, #5, #6) that integrators should know about.
`docs/advanced/Desktop.md` is worth calling out specifically — it's precisely the PKCE use case (native/mobile clients) and currently describes the flow without mentioning it.
Also while touching docs: `README.md` says "WordPress >= 4.8" against CI's 6.5 floor, `bin/readme.txt` says "Tested up to: 4.8", and `book.json` points at a legacy GitBook toolchain nothing in the repo can actually build (no `package.json`, no CI step for it).