Master OAuth 2.0: A Practical Guide to API Security