Block wp-login.php but allow oauth requests to passthrough.

custom login with wp-login block

add_action( 'login_init', 'secure_wp_admin' );
function secure_wp_admin() {

	/**
	 * Check if there is an redirect_url parameter during the login page.
	 *
	 * If the script has made it this far for WP OAuth Server, there will be redirect URL exposed for the login redirect
	 * required by WP OAuth Server. We can use this redirect as a flag to check for the path. If "oauth" is present, we
	 * should assume that the request is an oauth request and should not be redirected.
	 */
	$redirect = isset( $_GET['redirect_to'] ) ? $_GET['redirect_to'] : '';
	$url      = wp_parse_url( $redirect );

	if ( strpos( $url['path'], 'oauth' ) !== false ) {
		define( 'DOING_OAUTH', true );
	} else {
		if ( is_admin() || $GLOBALS['pagenow'] === 'wp-login.php' ) {
			if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
				wp_redirect( '/your-redirect' );
			}
		}
	}
}