I realized I don't have a page that just summarizes the different oauth grant types and I...probably should do that given how often I need to explain the difference between authorization_code and device_code (and client_credentials and resource owner password)