Adding a RESTful, OAuth API on top of Craft
Short answer: yes I have, I used OAuth 2 and I would absolutely do it again.

I wrote up my experience in general terms here but essentially it boiled down to two plugins, one on each site: one acting as the server and another as the client.

I used league/oauth2-server for the server and then tied in directly to the Dukt OAuth plugin for the client, but in retrospect it would’ve been simpler just using league/oauth2-client for that.

For transforming data like the Element API does I used league/fractal and then to get proper request behaviour I used zendframework/zend-diactoros.

Essentially I think this sort of thing is perfectly feasible in Craft, due to plugins being so flexible you can load whatever libraries you need and go nuts. Craft 3 could simplified things somewhat with Yii Modules as I’m guessing you could package up the whole API code as a module, but it shouldn’t be necessary.

Hope that helps!