Comment by paulddraper

Example: What is the purpose of OAuth having specifications for redirect URI allowlist AND PKCE?

None. They are entirely duplicative features.

But ... reason, reason, reason ... they both exist, and are going to exist, forever.

EDIT: I should say, PKCE is a functional superset of redirect URI allowlist.