The OAuth 2.1 Authorization Framework#

Dick Hardt (Hellō), Aaron Parecki, Ed. (Okta), Torsten Lodderstedt (SPRIND) — OAuth WG document

• Why: The consolidated successor to RFC 6749/6750 — every OAuth product roadmaps against it, and the WG milestone targets IESG submission in December 2026.
• What: A single standards-track specification replacing OAuth 2.0 and Bearer Token Usage, folding in OAuth for Native Apps (RFC 8252), Browser-Based Apps (RFC 10017), and the Security BCP (RFC 9700), and removing features found insecure: the implicit grant is gone, PKCE is required for the authorization-code flow, the redirect URI must be sent in token requests, sender-constrained tokens (DPoP, mTLS) are recommended over bare bearers, and refresh-token/client-credential behavior is specified in the base.
• How: Consolidation and normative merge of the existing document set, with an explicit "Differences from OAuth 2.0" section enumerating the removals so implementers can plan migrations.
• Where applicable: Every OAuth implementation, full stop. WG document at -17 — late-stage, expect the interesting discussion to be migration timing and 2.0-mode compatibility, not design.