I have built several OAuth integrations over the last few years, and I've always gone with the custom record approach. I know others have used the cache module so perhaps they can weigh in on its efficacy