/changelogs/oauth2/oauth-2-0-to-2-1
OAuth 2.0 to OAuth 2.1: what changes
The commands on this page have not been executed by our verification runner yet.updated 2026-10-20
- tool
- OAuth 2.0
- versions
- OAuth 2.0 (RFC 6749) → OAuth 2.1 (draft 16)
OAuth 2.1 is not a new protocol but a consolidation of OAuth 2.0 (RFC 6749) with the security practices learned since: PKCE (RFC 7636), native-app and browser-app guidance, Bearer Token Usage and the OAuth Security Best Current Practice (RFC 9700). Version 16 of the draft was published on 2026-09-02; it is still an Internet-Draft, but its rules match what current security guidance already asks for.
Changes from OAuth 2.0
| OAuth 2.0 | OAuth 2.1 |
|---|---|
| PKCE optional (recommended for native apps) | PKCE required for the authorization code grant; plain method removed (S256 only) |
| Redirect URI matching rules left to the server | exact string matching |
| Implicit grant (response_type=token) | removed |
| Resource owner password credentials grant | removed |
| Bearer token allowed in the query string | not allowed; use the Authorization header or the request body |
| Refresh tokens for public clients unrestricted | sender-constrained or one-time use (rotation) |
| redirect_uri sent again in the token request | omitted; PKCE prevents code injection instead |
| Client credentials in the body: optional for servers | servers must support credentials in the request body |
What to change in a client
- Use the authorization code grant with PKCE (
code_challenge_method=S256) for every client type, including server-side apps. - Replace implicit-grant single-page apps with code + PKCE, or a backend-for-frontend that keeps tokens off the browser.
- Replace the password grant with the code grant (or device authorization grant for devices without a browser).
- Send access tokens only in the
Authorization: Bearerheader.
Compatibility
Authorization servers that support both versions must keep accepting redirect_uri in the token request from OAuth 2.0 clients, so existing clients can migrate gradually. OpenID Connect response types such as response_type=id_token are not affected by the removal of response_type=token.
Sources
Related pages
commands · jwtDecode a JWT from the command line (header and payload)A JWT is three base64url parts joined by dots. Decode the header and payload with Node.js or base64 in one line; decoding is not verifying the signature.flags · httpSet-Cookie attributes: SameSite, Secure, HttpOnly, Max-AgeSet-Cookie attributes decide when browsers send a cookie: SameSite controls cross-site requests, None needs Secure, HttpOnly hides it from JavaScript.glossary · httpWhat does idempotent mean in HTTP?An HTTP method is idempotent if repeating the same request has the same effect on the server as sending it once: GET, PUT and DELETE are, POST is not.