IETF OAuth · Protocol
The OAuth 2.0 Authorization Framework
Lets a third-party application obtain limited, delegated access to an HTTP resource on behalf of a resource owner, by way of an authorization server that issues access tokens.
PublishedProposed Standard; updated by RFC 8252, RFC 8996 and RFC 9700Canonical documentrfc6749
Revisions
- rfccurrent
Relations 19
The OAuth 2.0 Authorization Framework is built on by 16
- JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization GrantspublishedDefines a JWT assertion grant and JWT client authentication for the token endpoint.Source
- OAuth 2.0 Dynamic Client Registration ProtocolpublishedRegisters OAuth clients; the client metadata it defines is reused by later documents.Source
- Proof Key for Code Exchange by OAuth Public Clients (PKCE)publishedExtends the authorization code grant with a code verifier.Source
- OAuth 2.0 Authorization Server MetadatapublishedPublishes the authorization server's endpoints and capabilities.Source
- OAuth 2.0 Token ExchangepublishedAdds the token exchange grant type to the token endpoint.Source
- Resource Indicators for OAuth 2.0publishedAdds the resource request parameter to the authorization and token endpoints.Source
- JSON Web Token (JWT) Profile for OAuth 2.0 Access TokenspublishedProfiles the access token the framework leaves opaque as a JWT.Source
- OAuth 2.0 Authorization Server Issuer IdentificationpublishedAdds the iss parameter to the authorization response.Source
- OAuth 2.0 Rich Authorization RequestspublishedAdds authorization_details alongside scope.Source
- OAuth 2.0 Demonstrating Proof of Possession (DPoP)publishedSender-constrains the framework's bearer tokens.Source
- OAuth Client ID Metadata DocumentWG draftDefines a client_id syntax and the authorization server behaviour for it.Source
- Best Current Practice for OAuth 2.0 SecuritypublishedUpdates the framework's security considerations and deprecates the implicit grant and password grant.Source
- OAuth 2.0 Protected Resource MetadatapublishedPublishes metadata for the framework's protected resources.Source
- OpenID Connect Core 1.0publishedAdds the ID Token and authentication semantics to the OAuth 2.0 flows.Source
- OpenID for Verifiable Presentations 1.0publishedCredential presentation is requested with an OAuth 2.0 authorization request.Source
- OpenID for Verifiable Credential Issuance 1.0publishedThe credential endpoint is an OAuth 2.0 protected resource.Source
The OAuth 2.0 Authorization Framework is replaced by 1
- The OAuth 2.1 Authorization FrameworkWG draftObsoletes RFC 6749 and RFC 6750 when published.Source
The OAuth 2.0 Authorization Framework is referenced by 2
- AI Identity Management System (AIMS)WG draftReviews how OAuth 2.0 grants apply when an agent acts for a user.Source
- Agent2Agent (A2A) ProtocolpublishedAgent Cards can declare an OAuth 2.0 security scheme, including its flows and scopes.Source
Defines in the shared model
No features of this document are recorded yet. Features are what the atlases observe and the explorer cites; they are added as the products need them.