Many apologies I've been off the scene for a long while with work commitments and also my old system died a few months back, but I've now begun to start back up.
Ive got a nice fast new server now up and running with multiple vmware virtual machines, I have a few bugs one with passing through my zwave dongle and the other with the dhcp server not giving out addresses which is weird but anyway I'm getting there.
So anyway before I left I had Alexa controlling my lights as well as scenarios/scenes and devices like my boiler for heating and hot water, it was fairly reliable and the Oauth2 part is simple to use once setup and not an issue using just plan old PHP it just needs a few tables set up in the database and the code pushed in to the web admin pages.
The main problem was that it wasn't really usable for end users as Amazon requires Oauth2 handshaking with a server in order to use the home skill kit and Amazon are very picky on the SSL certificates that you can use, I brought 4 from various budget companies like godaddy and none of them would work, so in the end I had to route the requests through a web server I have access to at work which has a high end corporate certificate.
You don't need oAuth with a custom skill however and i actually did a presentation with work before xmas where I created a custom skill to ask for company information and send the latest reports to users and things just as a sort of demo of whats possible so I may look at going down this route next.
The down side though is you would then have to use an activation word each time like "ask Linuxmce to set living room lights to 30%" but the up side is we should be able to do something like "ask Linuxmce to play Xmen in Living room" and control media which would be cool.
Anyway as soon as i get my lights working again through the normal means ill get back on the Alexa piece and see if i can help out 
Would love to work with you on this.
So far i have
Cloud:
SSL enabled cloud router with oauth authentication going.
Site with user login, no profile besides showing what is linked, ability to set location with nickname (no multi-location support yet)
Note that im open to sharing the cloud code with other developers since it is a box that connects to your house.
Amazon
Alexa smarthome integration app so you can say commands minus 'ask linuxmce' (lighting is only thing implemented now
Custom Alexa skill for media, so far video media is working
Cakephp used in cloud and on linuxmce. I dont like frameworks, but now that ive figured it out, the same code can be reused for multiple api's eg google and iftt.
Remaining before beta testing:
Implement oauth server on core, oauth client in cloud server so core can only be accessed with access token via those apis. Ive done this before, just requires some hours. I should have done it today but the promise of launching Frozen on the media director via lmce was too much of a pull
*Lots of testing
Both sites (cloud and core)
running php 7.2
Using Cakephp3 framework for api and user management in cloud, api on the core. It actually integrates moderately well with the existing DB, so no new user authentication mechanisms are needed.
-OAuth2 server security component
https://github.com/uafrica/oauth-server-OAuth client security component implemented in the cloud will be an updated variant of
https://bshaffer.github.io/oauth2-server-php-docs/cookbook/New db tables are needed on the core, but they are actually installed by a cakeplugin so....yeah we will need to see how that goes. i took the plunge myself, and have not seen any adverse effects on my core db wise.
-langston
