Comment by tyho

Just say no to the implicit grant. OAuth 2.1 removes most of the foot guns in OAuth: https://oauth.net/2.1/