Profile, Don't Invent: How Germany Chose OAuth 2.1 and FAPI 2.0

This is the second post in my series breaking down Germany’s federal API authorization blueprint for other governments to follow. The first post made the case that the whole thing rests on a single posture — profile, don’t invent. Today I want to show what that posture actually looks like when you make the first and most consequential decision: which authorization standard the entire federation is going to stand on.