How should OAuth 2.0 be designed for production?

For production, choose an appropriate flow, use authorization code with PKCE for interactive public clients, validate redirect URIs, minimize scopes, protect tokens, and use a trusted authorization server. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.