Comment by TZubiri

"Why do I need to implement OAuth2 if I'm using HTTP as transport, while an API key is enough for stdio?"

Because one is made for local and the other for connecting through the internet.