OAuth 2.0 RFC Reference
Core RFCs
OAuth 2 Bearer Token Usage (6750)
OAuth 2 Bearer Token Usage (6750)
OAuth 2 Authorization Framework (6749)
OAuth 2 Authorization Framework (6749)
Threat Model and Security Considerations (6819)
Threat Model and Security Considerations (6819)
This document gives additional security considerations for OAuth, beyond those in the OAuth 2.0 specification, based on a comprehensive threat model for the OAuth 2.0 protocol. This document is not an Internet Standards Track specification; it is published for informational purposes.
Proof Key for Code Exchange (PKCE - 7636)
Proof Key for Code Exchange (PKCE - 7636)
OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. This specification describes the attack as well as a technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced "pixy").
Device Authorization Grant (Device Code Flow - 8628)
Device Authorization Grant (Device Code Flow - 8628)
Authorization Request Extensions
JWT-Secured Authorization Request (JAR - 9101)
JWT-Secured Authorization Request (JAR - 9101)
Pushed Authorization Requests (PAR - 9126)
Pushed Authorization Requests (PAR - 9126)
This document defines the pushed authorization request (PAR) endpoint, which allows clients to push the payload of an OAuth 2.0 authorization request to the authorization server via a direct request and provides them with a request URI that is used as reference to the data in a subsequent call to the authorization endpoint.
Client Authentication
Assertion Framework for Client Authentication and Authorization Grants (7521)
Assertion Framework for Client Authentication and Authorization Grants (7521)
This specification provides a framework for the use of assertions with OAuth 2.0 in the form of a new client authentication mechanism and a new authorization grant type. Mechanisms are specified for transporting assertions during interactions with a token endpoint; general processing rules are also specified. The intent of this specification is to provide a common framework for OAuth 2.0 to interwork with other identity systems using assertions and to provide alternative client authentication mechanisms. Note that this specification only defines abstract message flows and processing rules. In order to be implementable, companion specifications are necessary to provide the corresponding concrete instantiations.
SAML 2.0 Profile for Client Authentication and Authorization Grants (7522)
SAML 2.0 Profile for Client Authentication and Authorization Grants (7522)
This specification defines the use of a Security Assertion Markup Language (SAML) 2.0 Bearer Assertion as a means for requesting an OAuth 2.0 access token as well as for client authentication.
JWT Profile for Client Authentication and Authorization Grants (7523)
JWT Profile for Client Authentication and Authorization Grants (7523)
This specification defines the use of a JSON Web Token (JWT) Bearer Token as a means for requesting an OAuth 2.0 access token as well as for client authentication.
Mutual-TLS Client Authentication and Certificate-Bound Access Tokens (mTLS - 8705)
Mutual-TLS Client Authentication and Certificate-Bound Access Tokens (mTLS - 8705)
Proof of Possession
Mutual-TLS Client Authentication and Certificate-Bound Access Tokens (mTLS - 8705)
Mutual-TLS Client Authentication and Certificate-Bound Access Tokens (mTLS - 8705)
Demonstrating of Proof of Possession at the Application Layer (draft-ietf-oauth-dpop)
Demonstrating of Proof of Possession at the Application Layer (draft-ietf-oauth-dpop)
This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens.
Proof-of-Possession Key Semantics for JWT (7800)
Proof-of-Possession Key Semantics for JWT (7800)
Token Management
Token Introspection (7662)
Token Introspection (7662)
This specification defines a method for a protected resource to query an OAuth 2.0 authorization server to determine the active state of an OAuth 2.0 token and to determine meta-information about this token. OAuth 2.0 deployments can use this method to convey information about the authorization context of the token from the authorization server to the protected resource.
Token Revocation (7009)
Token Revocation (7009)
Token Exchange (8693)
Token Exchange (8693)
This specification defines a protocol for an HTTP- and JSON-based Security Token Service (STS) by defining how to request and obtain security tokens from OAuth 2.0 authorization servers, including security tokens employing impersonation and delegation.
Tag @pamelarosiedee on twitter if you see problems
Tag @pamelarosiedee on twitter if you see problems
Explore other Linktrees
elan.media
@elan.media
whywontyoudateme
@whywontyoudateme
harperzilmer
@harperzilmer
babynezz
@babynezz
chappellroan
@chappellroan
Boze vs The World
@bozevstheworld
royelotis
@royelotis
Mythical Kitchen
@mythicalkitchen
shaep.co
@shaep.co
davestewart
@davestewart
previous
next
Discover more
See all
@NTProdutosAutomotivos
@sitijuanisj7
@districtarchcenter
@the_shamanic_way
@garminu
@jeromejoets
@intiralandasanulin
@Amber.desink
@cumar_tattoo
@nemesis.1969
@CaptainJohnRice
@alainasimone20
@fathersjoypodcast
@somosgecal
@vivazmidia
@kaskus.niepospolitus
@downtownerlv
@fikriputraba
@jitendraworklink
@rogeriominhajoia
@VitoriaDinizParcerias
@melsyarniverse
@x2lovely
@keturahcartwright25
@evanhavel
@mountainpearlmagazine
@pajama_lover
@ziag05
@mcmpaarl
@TheMrNC7717
@MadebyMarisJ
@AlejandroLuquee
@Oversats
@thelucedattic
@dvernisaj.design
@jewlz_7a9ara
@lyfestylersnews
@calltoworshipproject
@linktr.ee_addyson
@Topcountrycap
@potterycorner
@Stopperscroller
@pointlomabjj
@felipe.franke
@ofc.prismastudios
More from Linktree
Products
Link in bio + tools
Manage your social media
Grow and engage your audience
Monetize your following
Measure your success
Templates
Marketplace
Learn
Resources
How to use Linktree
Pricing
Link in bio + tools
Link in bio
Customize your Linktree
Link shortener
Create trackable, shareable short links
QR code generator
Turn links into scannable QR codes
Canva Background Editor
Import your custom designs from Canva into your profile
Linktree for every social platform
Grow and engage your audience everywhere
Instagram
TikTok
LinkedIn
X
Manage your social media
Schedule and auto-post
Hands-free, hassle-free social media planning
Instagram auto reply
Automated replies and DMs triggered by comments
AI content & caption generator
Instant AI-powered post ideas and captions
Hashtag generator
Trending hashtag suggestions for better reach
Social integration for every social platform
Plan, auto post, and share across all platforms
Instagram
TikTok
Facebook
Pinterest
LinkedIn
Threads
Youtube
Grow and engage your audience
Collect leads with contact forms
Turn visitors into subscribers
Manage and activate your audience
Organize, tag, and track contacts
Send contacts to email tools
Sync with Mailchimp, Klaviyo, Kit & more
Monetize your following
Earn with a Linktree Shop
Sell products and earn commission
Sell an online course
Create and sell your expertise easily
Host digital products
Sell digital products and build your email list
Earn by hosting sponsored links
Share brand offers and earn for every sign-up or sale
Get rewarded for growing your Linktree
Earn points, level up and unlock cash bonuses
Booked and paid, easily
Offer sessions and earn from your expertise
Measure your success
Social + link analytics
Track clicks, engagement and audience insights
Resources
Read our blog
All the latest tips, tricks and growth strategies
Success Stories
Real people, real results on Linktree
How to use Linktree
Linktree Help Centre
Get answers, guides and support