I feel the syntax you proposed is better:

    %w(authorization_code implicit password_credentials client_credentials)

and we can avoid all the potential symbol DoS's