OIDC is the most important protocol for authedication – authorization and Keycloak should be compliant with OIDC specification as much as possible. Keycloak already supports well OAuth/OIDC flows.
Some bugs exist in OAuth/OIDC flows and some OAuth/OIDC flows need to be enhanced. Our team has made several PR in order to improve Keycloak support for OAuth/OIDC flows. These are:

• Support scope parameter in refresh flow
• device code flow error responses not in json format
• Include 'urn:ietf:params:oauth:grant-type:token-exchange' in grant_types_supported field of Keycloak OP metadata, if token-exchange is enabled
• hide specific scopes from scopes_supported in discovery endpoint
• offline_access scope must always return refresh_token

Details can be showed in related github issues. Could you review these PRs? We could discuss anything needed here.