Luma Auth
An open-source OAuth2 and OIDC server: complete enough for a real application, small enough that you can read the authorization endpoint and know what it does. PKCE, refresh rotation, introspection, revocation, pushed authorization requests, passwordless flows, and a full consent UI.