Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS?
In the frontend (app or webapp), Oauth2 is useful to protect the user credentials by storing a token and not the credentials in local storage, filesystem or cookies, and if there is no https channel is not a good idea to pass the credentials on each call rather than the token that can be revoked or eventually expire.
But why going through the implementation process of oauth2 server side to communicate to another server? Credentials are stored on the server, if there is a breach, well, token or not you are screw, the SSL channel protects you from men in the middle and replay attacks. How is this system more secure using outh2 instead of Basic Auth?
There's a similar question about this topic but with no concrete answer, so I'm trying to bring up the topic again Oauth2 vs APIKey in a server to server communication