Network access authentication performed by constrained devices is a cornerstone of security in Internet of Things (IoT) environments. In this regard, the Internet Engineering Task Force (IETF) has recently standardised CoAP-EAP (RFC 9820), an authentication service that transports the Extensible Authentication Protocol (EAP) over Constrained Application Protocol (CoAP), thus bringing this authentication framework to the IoT realm. This paper analyses and provides a comprehensive overview of CoAP-EAP, explaining the main design decisions made throughout its standardisation, describing its applicability across different network infrastructures, and presenting a proof-of-concept implementation that has been evaluated in a realistic IoT testbed.