For 2.3, I'm replacing bdApi with xf native built in Oauth2 as I only use Authorization Code. It does work fine but it's safer with support for security patches and it's transparent to do the switch. I doubt there will be updates as he is MIA for long time by now.