#ZegnatThis is also why the IndieAuth spec (which is really mostly an extension of OAuth2) mostly focusses on taking away things like pre-registered clients etc. So if you are an unknown service, you can still have someone authenticate with IndieAuth