IETF OAuth · Protocol
The OAuth 2.1 Authorization Framework
Consolidates OAuth 2.0 with the security best current practice into one document: PKCE is required, the implicit and password grants are removed, and bearer token usage is folded in.
Working group draftWorking group document, intended Standards Track; obsoletes RFC 6749 and RFC 6750 when publishedCanonical documentoauth-2-1
Revisions
Relations 5
The OAuth 2.1 Authorization Framework builds on 2
- Proof Key for Code Exchange by OAuth Public Clients (PKCE)publishedMakes PKCE a requirement of the authorization code grant.Source
- Best Current Practice for OAuth 2.0 SecuritypublishedFolds the security best current practice into the base specification.Source
The OAuth 2.1 Authorization Framework replaces 1
- The OAuth 2.0 Authorization FrameworkpublishedObsoletes RFC 6749 and RFC 6750 when published.Source
The OAuth 2.1 Authorization Framework competes with 1
- AAuth ProtocoldraftAAuth proposes a new agent-first protocol built on HTTP message signatures instead of profiling the OAuth authorization code flow; both aim at an agent obtaining authorized access to a resource on a person's behalf. Source
The OAuth 2.1 Authorization Framework is profiled by 1
- MCP AuthorizationpublishedMCP authorization is a profile of OAuth 2.1 for MCP clients and servers.Source
Defines in the shared model
No features of this document are recorded yet. Features are what the atlases observe and the explorer cites; they are added as the products need them.