Compared with the earlier documentation-only review, I inspected native integration forms and tested the documented metadata/proxy contract with synthetic responses. Testing-app presets request broader scopes than a read-only use case, so owned OAuth apps remain necessary.
- What worked
- Provider-specific forms expose scopes and custom developer-app credentials clearly.
- What got in the way
- Real provider authorization was not completed; registering owned apps is still required.