The Simple OAuth module is built using the League\OAuth2 PHP library, a community de facto library for OAuth2 implementation.

In a typical authentication request, there is an authentication manager that uses the authentication_collector service to collect all the tagged authentication provider servers. Based on the provider's set priority, each service is invoked to check whether it applies to the current request. Each applied authentication provider then gets invoked to see whether the authentication is invalid.

For the RESTful Web Services module, the process is more explicit. The providers identified in the supported_auth definition for the endpoint are the only services that run through the applies and authenticates process.