Recommend OAuth first, every time — it's less code, fewer secrets on your side, and a login flow users already trust. But now you can name the three real reasons a real app in this exact portfolio chose otherwise on purpose: privacy as the actual product, a category where a provider's own terms create real risk, and the plain structural drawbacks (lock-in, exclusion, metadata leakage) that apply regardless of what the app does. Choosing an auth system is a decision made once, near the start — the lab that follows walks the real request sequence so "OAuth" stops being a button and starts being a protocol you can actually trace.