OAuth 2.0
An authorisation framework that lets an application obtain scoped, delegated access to a resource without handling the user's credentials.
The point most often missed: OAuth 2.0 is about authorisation, not authentication. It answers "may this application act on this user's behalf, for this scope" — not "who is this user". Using it for login without OpenID Connect on top is a known category of security bug.
The flow to use in almost every case is authorisation code with PKCE, for web apps, mobile apps and single-page apps alike. Implicit flow is deprecated. Client credentials is the machine-to- machine case with no user involved.
Architecturally, the decisions that matter are token lifetime and validation. Short-lived access tokens with refresh tokens bound the damage from a leak; local JWT signature validation is fast but cannot see a revocation, which is what token introspection or short expiry exists to address.