Docs that refer to fields should always refer to the JSON tag and not the Go struct field name

$ kubectl explain oidcidentityprovider.spec.authorizationConfig

KIND:     OIDCIdentityProvider
VERSION:  idp.supervisor.pinniped.dev/v1alpha1

RESOURCE: authorizationConfig <Object>

DESCRIPTION:
     AuthorizationConfig holds information about how to form the OAuth2
     authorization request parameters to be used with this OIDC identity
     provider.

FIELDS:
   additionalScopes	<[]string>
     AdditionalScopes are the scopes in addition to "openid" that will be
     requested as part of the authorization request flow with an OIDC identity
     provider. In the case of a Resource Owner Password Credentials Grant flow,
     AdditionalScopes are the scopes in addition to "openid" that will be
     requested as part of the token request (see also the allowPasswordGrant
     field). By default, only the "openid" scope will be requested.

   allowPasswordGrant	<boolean>
     AllowPasswordGrant, when true, will allow the use of OAuth 2.0's Resource
     Owner Password Credentials Grant (see
     https://datatracker.ietf.org/doc/html/rfc6749#section-4.3) to authenticate
     to the OIDC provider using a username and password without a web browser,
     in addition to the usual browser-based OIDC Authorization Code Flow. The
     Resource Owner Password Credentials Grant is not officially part of the
     OIDC specification, so it may not be supported by your OIDC provider. If
     your OIDC provider supports returning ID tokens from a Resource Owner
     Password Credentials Grant token request, then you can choose to set this
     field to true. This will allow end users to choose to present their
     username and password to the kubectl CLI (using the Pinniped plugin) to
     authenticate to the cluster, without using a web browser to log in as is
     customary in OIDC Authorization Code Flow. This may be convenient for
     users, especially for identities from your OIDC provider which are not
     intended to represent a human actor, such as service accounts performing
     actions in a CI/CD environment. Even if your OIDC provider supports it, you
     may wish to disable this behavior by setting this field to false when you
     prefer to only allow users of this OIDCIdentityProvider to log in via the
     browser-based OIDC Authorization Code Flow. Using the Resource Owner
     Password Credentials Grant means that the Pinniped CLI and Pinniped
     Supervisor will directly handle your end users' passwords (similar to
     LDAPIdentityProvider), and you will not be able to require multi-factor
     authentication or use the other web-based login features of your OIDC
     provider during Resource Owner Password Credentials Grant logins.
     AllowPasswordGrant defaults to false.

1. AuthorizationConfig should be authorizationConfig
2. AdditionalScopes should be additionalScopes
3. AllowPasswordGrant should be allowPasswordGrant

Find the Go API definitions or documentation source that produces the shown kubectl explain output for AuthorizationConfig. Check the references to AuthorizationConfig, AdditionalScopes, and AllowPasswordGrant, then update them to their JSON-tag names and run the relevant documentation or schema check. Done means the generated field names and descriptions consistently use authorizationConfig, additionalScopes, and allowPasswordGrant.