Creating an API is not too difficult. However, OAuth2.0 is a bitch. Who the hell thought this was reasonable?

The big companies who recieve more information about their users. (Google /favebook /twitter)

Use laravel.

Have not implemented OAuth2 myself but this looks like a FANTASTIC guide for anyone interested...it's mostly high level but has some legitimate suggestions and warns about common pitfalls.

https://stormpath.com/blog/...

There is no real need to implement the protocol yourself, there are plenty of great implementations for probably any modern language and framework. There are even ready middlewares to auth with it ready for you, and if you are feeling adventurous there are ready frameworks to deploy and run an authority server...