Aaron Parecki
- Maintainer of oauth.net and author of OAuth 2.0 Simplified
- Active contributor to the IETF OAuth working group
- Co-editor of OAuth 2.1 and related drafts
Bio
Aaron Parecki is one of the most accessible voices in OAuth and OpenID Connect. He maintains oauth.net, wrote OAuth 2.0 Simplified, and is an active contributor to the IETF OAuth working group, including consolidation work behind OAuth 2.1. His explanations have helped a generation of developers implement delegated authorization correctly.
Profile built from public IETF, oauth.net, and personal-site records.
Where their work shows up
Parecki's work is the reason most developers can read OAuth 2.0 at all. The consolidation effort behind OAuth 2.1, which makes PKCE mandatory and removes the implicit and password grants, folds a decade of security guidance into defaults. See OAuth vs OIDC for the distinction his writing is most often cited to settle.
Podcasts
- Open Authorization In The World Of AI With Aaron Parecki · The Secure Developer · 2025-06-10
- OAuth 2.0 from Protecting APIs to Supporting Authorization & Authentication - Aaron Parecki - ASW #289 · Application Security Weekly · 2024-06-25
- OAuth, "It's complicated." (Changelog Interviews #456) · The Changelog · 2021-08-23
- What's new with OAuth2.1 with Aaron Parecki · Identity, Unlocked · 2020-09-27
Related on Start with Identity
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still