OAuth 2.1 is a consolidation of OAuth 2.0 and the extensions and security practices that have become standard since 2012. It is not a new protocol — it folds the Security Best Current Practice into the core, makes PKCE mandatory for authorization code flows, and removes the implicit and resource owner password credentials grants entirely.
OAuth 2.1
OAuth 2.1 — OAuth 2.1 is a consolidation of OAuth 2.0 and the extensions and security practices that have become standard since 2012. It is not a new protocol — it folds the Security Best Current Practice into the core, makes PKCE mandatory for authorization code flows, and removes the implicit and resource owner password credentials grants entirely.
- A tidying, not a rewrite - Existing correct deployments are already close to 2.1 compliant.
- Implicit and password grants removed - Not deprecated — removed from the specification.
- PKCE mandatory - For all authorization code flows.
- Redirect URI matching tightened - Exact string matching, closing a long-standing class of open-redirect attacks.
OAuth 2.1 is where the industry’s authorization practice is supposed to land, and the gap to it is measurable: 775 contracts declaring implicit and 72 declaring the password grant, most of them Swagger 2.0 documents written before the guidance existed and never revisited. See The OAuth 2.0 Standard.
