The current oauth implementation only supports public clients, that is user-facing apps themselves can authenticate a user but the majority of apps will want to authenticate on the server. These are called confidential clients and include some extra key signing steps and some additional data send in each request.
We should support this! Most users will want to do confidential auth as part of a "proper" full-stack app.