This question is inspired by posts like this:
and many others trying to make providers “fit” for particular OAuth2.0 problems with various workarounds.
I don’t mean to put anyone on the spot— the Forge doco does tout Providers as “the” OAuth2.0 method. But I feel like it’s not really making sense in this context, or in any case where one doesn’t have a nice profile endpoint (or maybe it’s secured with a different auth server). It feels a bit haphazard that Providers works beautifully in some instances but is annoying/requires workarounds in others if it’s supposed to be a general method.
Obviously the name and requirements would suggest it’s tailored for IdP frontend authentication scenarios. Is this correct? If so, what do Forge developers do to implement, say auth code flow for an app without Providers?