How do OAuth 2.0 and OpenID Connect differ, and why is authorization code with PKCE the usual interactive login flow?

In production I draw the trust boundaries before choosing a flow. A service with no user normally uses client credentials, while delegated user calls preserve both the user and client context. Tokens are kept out of URLs and unsafe browser storage, refresh-token rotation and revocation follow the identity provider's capabilities, and the application does not build its own token issuer casually. I separate authentication claims from application authorization because group or role claims can become stale, oversized, or tenant-ambiguous. I also account for key rotation, clock skew, logout semantics, consent, callback failures, and provider outages. Logs capture correlation and failure category without token values. Integration tests cover invalid state, wrong audience, expired tokens, replayed callbacks, and the difference between an unauthenticated challenge and an authenticated user who lacks permission.