Secrets vs Keys in OAUTH

When you create oauth clients, you are provided with a `client_id` and a `client_secret`. They are used to authenticate a client (whether a human or a machine), before you do something important, like sharing resources.

**But isn’t that subpar security ?**

Passkeys are currently the gold standard for websites user authn. They are mathematically secure as long as you don’t fuck-up the implementation.

Why is oauth using the old concept of a username+password for something as crucial as resource access …

authenticate client clients cybersecurity human important isn keys machine oauth passkeys resources secrets security sharing standard websites