OAuth2 lets you grant an app limited, revocable access to your data without ever giving it your password.
OAuth2 answers what the app may do; OIDC adds a signed ID token that answers who the user is.
PKCE binds the code to a one-time secret only the real client knows, so a stolen code cannot be redeemed.
The browser only carries a throwaway code; the real token is swapped privately on the backend using the client secret.
Client Credentials is a service authenticating as itself, with no user and no consent, to call another service.