Earlier quoted context omitted.
Would love to discuss it. I think this could be a solid business. I have little interest in building it myself, but may have to in order to make my other projects easier to self-host. I keep bringing it up hoping to find out it already exists. What issues did you run into with OAuth2? Are you open to sharing your design doc?
If you want to contact me, I'm shell@alterednarrative.net on email and XMPP. I'll try and find whether I still have the design notes, but doubt it; I've been through a couple of laptops since and lost a lot. One of my goals was that the flow could start from a service provider - you type in the domain name you want the service to be bound to on the service provider's website, and it goes from there. If you were to us…
I'm not a big fan of pre-registered clients in the first place. Ideally any client should be able to talk to any OAuth2 server that speaks the same profile, ie endpoints and scopes. Aaron Parecki describes a way to allow "anonymous" clients here[0]. As I understand that's how IndieAuth is implemented. But I'm still relatively new to OAuth, and I don't doubt there could be subtle security issues. Do you have any thoughts on that?
[0]: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web