I wouldn't be opposed to having a separate module for the OAuth client / accesstoken CRUD. Though for OracId and MediaCore, isn't OAE a *consumer*, whereas oae-oauth would be focussed on making us a *provider* ?