Install via Extras Installer or download directly from https://modx.com/extras/package/oauth4server
For usage see README.
Note on security:
The OAuth4Server Extra doesn't grant any permissions whatsoever, on its own. It only provides a way to grant, manage, revoke and verify access tokens. Call the Snippet [[!verifyOAuth4]] in your Resource/Template, and the Resource will return an unauthorized or error response, if the request isn't accompanied by a valid access token. You can choose to do whatever you like, with the verified request—the possibilities are endless.
New in OAuth2Server 0.9.0-dev1