The API documentation is wrong.

If you try to use oauth you get the following error:

Refused to display 'https://itch.io/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Since the error happens when you have a secure connection with the itch.io website, it looks like a major bug with the platform.