OAuth 2.0 Authorization Framework - draft-ietf-oauth-v2-30 - Standards Track

Sep 19, 2026

Upload by Jasmine

OAuth 2.0 authorization framework specification describes how third-party applications obtain limited access to an HTTP service, either on behalf of a resource owner through an approval interaction or on their own behalf. It replaces and obsoletes the OAuth 1.0 protocol in RFC 5849. The memo is an Internet-Draft intended for Standards Track status, with defined scope for roles, protocol flow, authorization grants, token handling, refresh behavior, endpoints, security considerations, and extensibility.

LanguageEnglish

CategoryGeneral

FormatPDF

Pages49

Reading Time17 min

AccessFree to download

Introduction

Roles

Protocol Flow

Authorization Grant

Client Registration

Client Types

Client Identifier

Client Authentication

Protocol Endpoints

Authorization Endpoint

Token Endpoint

Access Token Scope

Obtaining Authorization

Authorization Code Grant

Implicit Grant

Resource Owner Password Credentials Grant

Client Credentials Grant

Extension Grants

Issuing an Access Token

Refreshing an Access Token

Accessing Protected Resources

Access Token Types

Extensibility

Native Applications

Security Considerations

Client Authentication

Access Tokens

Refresh Tokens

IANA Considerations

Registries

OAuth Working Group Internet-Draft Obsoletes: 5849 (if approved) Intended status: Standards Track Expires: January 16 , 2013 D. Hardt , Ed. Microsoft D. Recordon Facebook July 15 , 2012 TOC The OAuth 2.0 Authorization Framework draft-ietf-oauth-v2-30 Abstract The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an [HTTP](HTTP) service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the [HTTP](HTTP) service, or by allowing the third-party application to obtain access on its own behalf. This specification replaces and obsoletes the OAuth 1.0 protocol described in RFC 5849. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF) . Note that other groups may also distribute working documents as Internet-Drafts . The list of current Internet-Drafts is at [http://datatracker.ietf.org/drafts/current/](http://datatracker.ietf.org/drafts/current/) . Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use InternetDrafts as reference material or to cite them other than as “work in progress .” This Internet-Draft will expire on January 16, 2013. Copyright Notice Copyright (c) 2012 IETF Trust and the persons identified as the document authors . All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents ([http://trustee.ietf.org/l](http://trustee.ietf.org/l)icense-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction 1.1. Roles 1.2. Protocol Flow 1.3. Authorization Grant 1.3.1. Authorization Code 1.3.2. Implicit 1.3.3. Resource Owner Password Credentials 1.3.4. Client Credentials 1.4. Access Token 1.5. Refresh Token 1.6. TLS Version 1.7. [HTTP](HTTP) Redirections 1.8. Interoperability 1.9. Notational Conventions 2. Client Registration 2.1. Client Types 2.2. Client Identifier 2.3. Client Authentication 2.3.1. Client Password 2.3.2. Other Authentication Methods 2.4. Unregistered Clients 3. Protocol Endpoints 3.1. Authorization Endpoint 3.1.1. Response Type 3.1.2. Redirection Endpoint 3.2. Token Endpoint 3.2.1. Client Authentication 3.3. Access Token Scope 4. Obtaining Authorization 4.1. Authorization Code Grant 4.1.1. Authorization Request 4.1.2. Authorization Response 4.1.3. Access Token Request 4.1.4. Access Token Response 4.2. Implicit Grant 4.2.1. Authorization Request 4.2.2. Access Token Response 4.3. Resource Owner Password Credentials Grant 4.3.1. Authorization Request and Response 4.3.2. Access Token Request 4.3.3. Access Token Response 4.4. Client Credentials Grant 4.4.1. Authorization Request and Response 4.4.2. Access Token Request 4.4.3. Access Token Response 4.5. Extension Grants 5. Issuing an Access Token 5.1. Successful Response 5.2. Error Response 6. Refreshing an Access Token 7. Accessing Protected Resources 7.1. Access Token Types 7.2. Error Response 8. Extensibility 8.1. Defining Access Token Types 8.2. Defining New Endpoint Parameters 8.3. Defining New Authorization Grant Types 8.4. Defining New Authorization Endpoint Response Types 8.5. Defining Additional Error Codes 9. Native Applications 10. Security Considerations 10.1. Client Authentication 10.2. Client Imperso

FAQs

What problem does the OAuth 2.0 authorization framework solve?

It enables third-party applications to obtain limited access to an HTTP service either on behalf of a resource owner via an approval interaction or on their own behalf.

How does this specification relate to OAuth 1.0?

The OAuth 2.0 authorization framework replaces and obsoletes the OAuth 1.0 protocol described in RFC 5849.

What is the purpose and status of this Internet-Draft?

It is submitted as an Internet-Draft in full conformance with BCP 78 and BCP 79, and it is intended as a Standards Track document.

Sep 19, 2026

Upload by Jasmine