Having now spent a day working with the @opencollective API, I honestly have serious doubts about trusting them with money, because their API is _that_ bad.

Like, they partially implement OAuth, with plenty of bugs that wouldn't exist if they'd read the spec.

They verify PKCE code_verifier on token requests even though they don't store the codeChallenge or codeChallengeMethod with their AuthorizationCodes.

They don't expose OAuth Authorization Server metadata, so you've gotta guess.

Their GraphQL API is borderline nonsensical, with documentation so hard to parse they may as well be telling developers "we don't have an API"

Oh, and regular 500 errors and network timeouts just for funsies.