OAuth 2.1 is a consolidation of OAuth 2.0 and the extensions and security practices that have become standard since 2012. It is not a new protocol — it folds the Security Best Current Practice into the core, makes PKCE mandatory for authorization code flows, and removes the implicit and resource owner password credentials grants entirely.
OAuth 2.1
OAuth 2.1 — OAuth 2.1 is a consolidation of OAuth 2.0 and the extensions and security practices that have become standard since 2012. It is not a new protocol — it folds the Security Best Current Practice into the core, makes PKCE mandatory for authorization code flows, and removes the implicit and resource owner password credentials grants entirely.
- A tidying, not a rewrite - Existing correct deployments are already close to 2.1 compliant.
- Implicit and password grants removed - Not deprecated — removed from the specification.
- PKCE mandatory - For all authorization code flows.
- Redirect URI matching tightened - Exact string matching, closing a long-standing class of open-redirect attacks.
OAuth 2.1 is where the industry’s authorization practice is supposed to land, and the gap to it is measurable: 775 contracts declaring implicit and 72 declaring the password grant, most of them Swagger 2.0 documents written before the guidance existed and never revisited. See The OAuth 2.0 Standard.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The OAuth 2.0 Standard
Removes the implicit and password grants outright; 775 and 72 contracts respectively still declare them.
