Is OAuth a standardized protocol, or does each website have its own implementation?

 OAuth is a standardized protocol, defined by the IETF (Internet Engineering Task Force) in RFC 6749 for OAuth 2.0. This means the core concepts and flow of OAuth (such as authorization grants, tokens, and scopes) are standardized and meant to be consistent across implementations.

However, while the protocol itself is standardized, websites and services can implement OAuth in slightly different ways. For example:

1. Scopes: The set of permissions that the user grants to the app can vary between services.
2. Flows: OAuth defines several types of authorization flows (e.g., Authorization Code Flow, Implicit Flow, Client Credentials Flow), but some services may only support certain ones depending on their needs.
3. Endpoints: The URLs for authorization, token, and other endpoints are specific to each provider.
4. Customization: Some services may extend OAuth with additional features or specific behaviors.

So, while the protocol is standardized, individual websites or services may have their own implementation details (like different token formats or authentication requirements) based on their needs. For example, Google, Facebook, and GitHub all implement OAuth 2.0, but each has slightly different APIs, scopes, and settings.